4 ms·

Last time I checked, by default, Authy codes were susceptible to SIM-swap attacks.[0] This is a bad article. You should perhaps consider switching off of Authe

Last time I checked, by default, Authy codes were susceptible to SIM-swap attacks.[0] This is a bad article. You should perhaps consider switching off of Authenticator to an Open Source manager like AndOTP; I think that's something reasonable to propose. But I don't understand the argument that I should be very concerned a lack of biometric locks, but not concerned about invalidating the "something you have" part of 2FA. I don't think it's horrible if someone uses an app like Authy. It's better than nothing. But this article didn't need to exist -- if you use Authenticator, just keep using it, it's fine. [0]: https://nitter.42l.fr/DanielShumway/status/1092081967007498242#m https://nitter.42l.fr/DanielShumway/status/10920819670074982...

latchkey 7y ago
Authy only has SIM issues if you give it your phone number. Don't do that.
- danShumway 7y ago
  The linked article is recommending Authy over Authenticator because backing up codes on multiple devices is too hard. If you're going to disable remote backup on Authy, then there's almost no advantage to switching away from Authenticator in the first place. Authy also doesn't allow local export of tokens, so there's no advantage there. I guess with Authenticator you lose the ability to lock your local tokens with a 4-digit pin, but who cares? 4-digit pins are not secure. I just checked on an old installation of Authy, and as far as I can tell there is no way to remove a phone number from the app itself, only change it. Maybe when you're installing you can skip that step. You can turn off remote backup entirely, but see above. If you use Authy, fine. It's still better than nothing. Really, getting people to use 2FA at all is the important battle, and the fight over which 2FA app is best is probably a waste of time. But Zdnet should not have written an article recommending people switch away from Authenticator to Authy when Authy's primary selling point is actually an attack vector that its own support website recommends disabling[0]. More to the point, the setting makes me trust Authy less in other security areas, because it's an attack vector that they easily could have plugged years ago -- and it makes me think they haven't actually thought that much about security. It's just bad UX to ask users for an encryption password when a single setting will non-transparently bypass that password requirement for some tokens. [0]: https://support.authy.com/hc/en-us/articles/360012427914-Is-the-Authy-App-Susceptible-to-a-SIM-Swap- https://support.authy.com/hc/en-us/articles/360012427914-Is-...
  - latchkey 7y ago
    You're right... I take back my comment. For some reason I thought that I had removed the number from Authy. I definitely have multiple devices turned off, which is definitely a confusing bit of UX. I had a long thread with @philnash (Twillio which owns Authy) not too long ago... this is his reasoning... https://news.ycombinator.com/item?id=22022814 https://news.ycombinator.com/item?id=22022814 While I do not agree with him about having SMS enabled at all, I can listen to his reasoning. I also agree with you... Authy has been treated a bit like a bastard child once it went to Twillio... the updates are few and far between. The UX isn't great and hasn't improved. Seems like a good opportunity to build something better.
- notlukesky 7y ago
  You can have a mobile number based backup and restore on SAASPASS Authenticator without SIM swap issues by adding a custom password as well. Alternatively you can have it on multiple devices without a mobile number by cloning it.
  - latchkey 7y ago
    Interesting. Never heard of that company before. What a horrid name. But their app looks interesting and is free for personal tier. I'll check it out. Thanks!
- manicdee 7y ago
  The only time I have ever seen Authy recommended was by sites using SMS TFA. I wanted to use TOTP or a challenge-response key but none of the sites I use Authy for support that.
jackson1442 7y ago
Last few times I've set up new devices, I've had to 2FA using an existing device on my account, not just the phone number. You can also disable the multi-device switch in settings which will not allow adding any new devices to your account until disabled.
Ayesh 7y ago
Authy keys are encrypted with your passphrase before they are synced. You can't reset this password even after SIM-swap.
- danShumway 7y ago
  Authy has its own in-house format for keys that it uses alongside the open Authenticator standard. Keys stored in Authy's format don't need a passphrase to decrypt. Authy could encrypt your entire database before syncing it, regardless of the key type, but they don't. I mention in the Twitter thread that (at least at the time) Cloudlfare's tokens fell under this category and were vulnerable to SIM-swap attacks[0]. It's possible since then Cloudlfare has switched back to using the Open standard instead. I haven't checked because I don't use Authy anymore -- I dropped Authy specifically because I personally verified 3 times in a row that my Cloudflare token did not require a passphrase to decrypt on new devices. [0]: https://nitter.42l.fr/DanielShumway/status/1092095395478556674#m https://nitter.42l.fr/DanielShumway/status/10920953954785566...

latchkey 7y ago

Authy only has SIM issues if you give it your phone number. Don't do that.

danShumway 7y ago
The linked article is recommending Authy over Authenticator because backing up codes on multiple devices is too hard. If you're going to disable remote backup on Authy, then there's almost no advantage to switching away from Authenticator in the first place. Authy also doesn't allow local export of tokens, so there's no advantage there. I guess with Authenticator you lose the ability to lock your local tokens with a 4-digit pin, but who cares? 4-digit pins are not secure. I just checked on an old installation of Authy, and as far as I can tell there is no way to remove a phone number from the app itself, only change it. Maybe when you're installing you can skip that step. You can turn off remote backup entirely, but see above. If you use Authy, fine. It's still better than nothing. Really, getting people to use 2FA at all is the important battle, and the fight over which 2FA app is best is probably a waste of time. But Zdnet should not have written an article recommending people switch away from Authenticator to Authy when Authy's primary selling point is actually an attack vector that its own support website recommends disabling[0]. More to the point, the setting makes me trust Authy less in other security areas, because it's an attack vector that they easily could have plugged years ago -- and it makes me think they haven't actually thought that much about security. It's just bad UX to ask users for an encryption password when a single setting will non-transparently bypass that password requirement for some tokens. [0]: https://support.authy.com/hc/en-us/articles/360012427914-Is-the-Authy-App-Susceptible-to-a-SIM-Swap- https://support.authy.com/hc/en-us/articles/360012427914-Is-...
- latchkey 7y ago
  You're right... I take back my comment. For some reason I thought that I had removed the number from Authy. I definitely have multiple devices turned off, which is definitely a confusing bit of UX. I had a long thread with @philnash (Twillio which owns Authy) not too long ago... this is his reasoning... https://news.ycombinator.com/item?id=22022814 https://news.ycombinator.com/item?id=22022814 While I do not agree with him about having SMS enabled at all, I can listen to his reasoning. I also agree with you... Authy has been treated a bit like a bastard child once it went to Twillio... the updates are few and far between. The UX isn't great and hasn't improved. Seems like a good opportunity to build something better.
notlukesky 7y ago
You can have a mobile number based backup and restore on SAASPASS Authenticator without SIM swap issues by adding a custom password as well. Alternatively you can have it on multiple devices without a mobile number by cloning it.
- latchkey 7y ago
  Interesting. Never heard of that company before. What a horrid name. But their app looks interesting and is free for personal tier. I'll check it out. Thanks!
manicdee 7y ago
The only time I have ever seen Authy recommended was by sites using SMS TFA. I wanted to use TOTP or a challenge-response key but none of the sites I use Authy for support that.

jackson1442 7y ago

Last few times I've set up new devices, I've had to 2FA using an existing device on my account, not just the phone number. You can also disable the multi-device switch in settings which will not allow adding any new devices to your account until disabled.

Ayesh 7y ago

Authy keys are encrypted with your passphrase before they are synced. You can't reset this password even after SIM-swap.

danShumway 7y ago
Authy has its own in-house format for keys that it uses alongside the open Authenticator standard. Keys stored in Authy's format don't need a passphrase to decrypt. Authy could encrypt your entire database before syncing it, regardless of the key type, but they don't. I mention in the Twitter thread that (at least at the time) Cloudlfare's tokens fell under this category and were vulnerable to SIM-swap attacks[0]. It's possible since then Cloudlfare has switched back to using the Open standard instead. I haven't checked because I don't use Authy anymore -- I dropped Authy specifically because I personally verified 3 times in a row that my Cloudflare token did not require a passphrase to decrypt on new devices. [0]: https://nitter.42l.fr/DanielShumway/status/1092095395478556674#m https://nitter.42l.fr/DanielShumway/status/10920953954785566...