4 ms·

Does anyone know if Twitch employees have two factor auth? Having access to an employee's account would be the easiest way to pull this off. It'd be strange if

Does anyone know if Twitch employees have two factor auth? Having access to an employee's account would be the easiest way to pull this off. It'd be strange if they don't have two factor auth, of course, but it's just as strange to have this large of a hack. I think if it is a simple case of an employee account takeover, then the attack would "work" to some extent at any company. Larger companies typically have strict data access requirements, though. Good luck finding the few employees who have raw access to Google password hashes, for example. And even more luck knowing how to get that data if you do.

some_furry 5y ago
> Does anyone know if Twitch employees have two factor auth? Yes, IIRC everyone at Amazon has a hardware security key (which is more secure than the standard mobile app TOTP most of us use everywhere online).
- ramesh31 5y ago
  >(which is more secure than the standard mobile app TOTP most of us use everywhere online). Is it though? The "wrench theory" applies here. It's not unthinkable that an employee was stalked on social media and had their key stolen.
  - bawolff 5y ago
    Its still more secure. Rubber hose cryptanalysis applies to both equally, but that doesn't mean there aren't other attacks that apply to totp which don't to yubikeys. More secure != perfectly secure.
    - xmprt 5y ago
      With a phone you need my passcode to accept to 2FA request (assuming lock screen notifications are disabled). I think yubikeys can work without a passcode as long you plug it in right?
      - some_furry 5y ago
        They require a physical touch.
      - tenryuu 5y ago
        Amazon still has a passkey requirement, it's not just a touch of the key, and these passwords are different to your user passwords at login.
      - bawolff 5y ago
        Right, but presumably the site is already asking for a password, and if the attacker can bypass one password, im not sure its a safe assumption that they cant bypass two. However fair enough. Some yubikeys do involve fingerprint scans too though. The main security benefit is unphishability. With yubikey/webauth crypto is used so you can't give the code to the wrong website. Phishing is a pretty major cause of account hacks generally, so pragmatically that is a very big win.
      - cheeze 5y ago
        It's still the same, 2fa. With a Yubikey, you need to use your password to log in to your computer, and then need to auth using Yubikey. With OTP app, you need to use your password to log into your computer, passcode for phone, and then auth. In both cases, it's something you know, and something you have. You could argue that the app based is a bit more secure in that you need two passwords. On the flipside, if your phone gets pwned, someone can access completely remote. Everything is a tradeoff.
        bawolff 5y ago
        Why would you need to log into your computer with a yubikey? Wouldn't any computer (including the attacker's computer) work?
  - some_furry 5y ago
    Yes. I don't know which protocols they use (obviously), but if they use WebAuthn, everything is public-key signatures. Even if you leak everything from the server, public keys buy you nothing. https://webauthn.guide/ https://webauthn.guide/
AustinDev 5y ago
Every Twitch Developer has 2FA even 3rd party developers are required to have 2FA I also think, but don't know, that this applies to Twitch Broadcaster Partners as well in order to have their tax information in the system. Luckily iirc from a conversation with a senior Twitch engineer the Tax information backend has been migrated to Amazon. So hopefully that did not leak... Because that would be full legal name and addresses of a ton of streamers that likely have stalkers.
- lrae 5y ago
  Twitch partners also have forced 2FA for quite some time now, should be a couple of years now - at least more than a year though. Covid killed my sense of time.

some_furry 5y ago

> Does anyone know if Twitch employees have two factor auth? Yes, IIRC everyone at Amazon has a hardware security key (which is more secure than the standard mobile app TOTP most of us use everywhere online).

ramesh31 5y ago
>(which is more secure than the standard mobile app TOTP most of us use everywhere online). Is it though? The "wrench theory" applies here. It's not unthinkable that an employee was stalked on social media and had their key stolen.
- bawolff 5y ago
  Its still more secure. Rubber hose cryptanalysis applies to both equally, but that doesn't mean there aren't other attacks that apply to totp which don't to yubikeys. More secure != perfectly secure.
  - xmprt 5y ago
    With a phone you need my passcode to accept to 2FA request (assuming lock screen notifications are disabled). I think yubikeys can work without a passcode as long you plug it in right?
    - some_furry 5y ago
      They require a physical touch.
    - tenryuu 5y ago
      Amazon still has a passkey requirement, it's not just a touch of the key, and these passwords are different to your user passwords at login.
    - bawolff 5y ago
      Right, but presumably the site is already asking for a password, and if the attacker can bypass one password, im not sure its a safe assumption that they cant bypass two. However fair enough. Some yubikeys do involve fingerprint scans too though. The main security benefit is unphishability. With yubikey/webauth crypto is used so you can't give the code to the wrong website. Phishing is a pretty major cause of account hacks generally, so pragmatically that is a very big win.
    - cheeze 5y ago
      It's still the same, 2fa. With a Yubikey, you need to use your password to log in to your computer, and then need to auth using Yubikey. With OTP app, you need to use your password to log into your computer, passcode for phone, and then auth. In both cases, it's something you know, and something you have. You could argue that the app based is a bit more secure in that you need two passwords. On the flipside, if your phone gets pwned, someone can access completely remote. Everything is a tradeoff.
      - bawolff 5y ago
        Why would you need to log into your computer with a yubikey? Wouldn't any computer (including the attacker's computer) work?
- some_furry 5y ago
  Yes. I don't know which protocols they use (obviously), but if they use WebAuthn, everything is public-key signatures. Even if you leak everything from the server, public keys buy you nothing. https://webauthn.guide/ https://webauthn.guide/

AustinDev 5y ago

Every Twitch Developer has 2FA even 3rd party developers are required to have 2FA I also think, but don't know, that this applies to Twitch Broadcaster Partners as well in order to have their tax information in the system. Luckily iirc from a conversation with a senior Twitch engineer the Tax information backend has been migrated to Amazon. So hopefully that did not leak... Because that would be full legal name and addresses of a ton of streamers that likely have stalkers.

lrae 5y ago
Twitch partners also have forced 2FA for quite some time now, should be a couple of years now - at least more than a year though. Covid killed my sense of time.