3 ms·

That's not Authy/Google Authenticator. That's social engineering their way into getting a persons text messages for SMS 2FA.

• chatmasta 9y ago
  If you can compromise the iCloud account of an iOS user (pretty sure iOS 2fa is only SMS based), then you can install google authenticator on your own device. I'm sure it's more complicated than that in reality, but if you have SMS access, you only need to find one weak link in the chain including iCloud/google, email provider, app provider, etc.
  • 15155 9y ago
    > install google authenticator on your own device. You sure can, but will you then have the requisite TOTP secrets?
    • joosters 9y ago
      No. iCloud backups don't contain keychains, where the Google authenticator stores its seeds.
      • chatmasta 9y ago
        Doesn't iOS keep keychain synced with iCloud keychain? Or at least, it's user configurable. I'm pretty sure I opted out of it. Good news is according to apple [0], you can protect your icloud keychain with a six digit code required to move the keychain to a new device. [0] https://support.apple.com/en-us/HT204085 https://support.apple.com/en-us/HT204085