Authy has its own in-house format for keys that it uses alongside the open Authenticator standard. Keys stored in Authy's format don't need a passphrase to decr

Authy has its own in-house format for keys that it uses alongside the open Authenticator standard. Keys stored in Authy's format don't need a passphrase to decrypt. Authy could encrypt your entire database before syncing it, regardless of the key type, but they don't. I mention in the Twitter thread that (at least at the time) Cloudlfare's tokens fell under this category and were vulnerable to SIM-swap attacks[0]. It's possible since then Cloudlfare has switched back to using the Open standard instead. I haven't checked because I don't use Authy anymore -- I dropped Authy specifically because I personally verified 3 times in a row that my Cloudflare token did not require a passphrase to decrypt on new devices. [0]: https://nitter.42l.fr/DanielShumway/status/1092095395478556674#m https://nitter.42l.fr/DanielShumway/status/10920953954785566...