5 ms·
While I was working at a blockchain forensics company (we built one of the first AI backed block-explorers both for Bitcoin and Ethereum & our service was also
by tessi3r 8y ago
While I was working at a blockchain forensics company (we built one of the first AI backed block-explorers both for Bitcoin and Ethereum & our service was also used to identify the DAO hack), both myself and my boss were targeted multiple times a year with this kind of attack even though we held no crypto through the company. It seemed that just since my name was on the web with the word crypto I was a target.
To this day I have a personal phone and a revolving burner I only use for non-SMS 2FA with an unlisted number, which is kept in an EMF proof bag while not in use.
Security for this kind of thing is an absolute joke.
Granted, this guy should've known better granted the value of his holdings... Most also don't know that accounts such as Authy and other non-SMS 2FA authenticators can still be stolen if your mobile number is stolen.
However, I'm still waiting for a carrier that creates a system that can't be trivially socially engineered by bored Chinese scammers...
- avian 8y ago> Most also don't know that accounts such as Authy and other non-SMS 2FA authenticators can still be stolen if your mobile number is stolen. I was under the impression that apps like Authy and Google Authenticator have no connection with the telephone network/phone number. Do you have any reference that claims otherwise?
- rubatuga 8y agoMaybe he means phone -> google account -> android backup -> 2fa keys?
- koolba 8y agoNo that’s wrong. TOTP based 2FA is totally out of band with the only attack vectors being losing your physical device (or a device backup!) or leaking of the secret from the server side.
- testvox 8y agoNo that's wrong, authy backs up your TOTP seed to their server and will give them out to anyone who gains access to your authy account and can verify that they can receive sms messages sent to the number associated with the authy account. (Though they are encrypted and authy does not store the encryption keys).
- LyndsySimon 8y agoThat's a vulnerability of Authy's service, not TOTP. I have some of my more important services tied to an older Yubikey. The only attack vectors for it would be on the server-side and the physical key.
- Alex3917 8y agoGoogle Authenticator doesn’t, Authy does. That’s why you’re not supposed to use Authy for crypto.
- guildenstern 8y agoAuthy specifically stores your account in the cloud and can be recovered using SMS. They have a 24 hour warning period during which the email address on file receives multiple notifications that a recovery is being attempted with the option to cancel but if someone has control over your phone number for an extended period of time they can absolutely take over your Authy account. I found this out when my Authy account was corrupted somehow and support said, hey no worries just go through the recovery process. Google Authenticator is offline only and is not vulnerable.
- tessi3r 8y agoI mentioned this because I know multiple people who've had authy / other authenticators compromised down the line from social engineering attacks. Even if you can be alerted, usually it's too late by the time you realize what's happened to your creds.
- matwood 8y agoDid they not put a password on the Authy backup?
- parliament32 8y agoYes but your backup is encrypted by a password. So even if someone steals your number for long enough to go through recovery, they still need to be able to decrypt the backup. >this password is not stored anywhere on Authy's servers! If you forget the password and none of your devices are synched, your tokens are lost and you will need to delete them and start over https://support.authy.com/hc/en-us/articles/115001750008-Backups-and-Sync-in-Authy https://support.authy.com/hc/en-us/articles/115001750008-Bac...
- sp332 8y agoStoring your account in the cloud is optional with Authy at least.
- zchrykng 8y agoAuthy at least will let you "recover" your account by them sending a text message to the associated phone number. Tap the link in the message and presto, 2FA codes.
- deleted 8y ago[deleted]