8 ms·

It shouldn't. You can just use authy, which allows you to onboard devices using your phone number, and then a password to decrypt the existing entries. If you u

It shouldn't. You can just use authy, which allows you to onboard devices using your phone number, and then a password to decrypt the existing entries. If you use 2fa with authy, remember that password, and remember your password Manager's password, something like this scenario won't ruin your life.

tluyben2 4y ago
With 'old' banks (and other systems that use these tokens) with a physical token, you can (often?) not do that.
kalleboo 4y ago
My bank doesn't use TOTP but rather the Swedish BankID system for 2FA
jimmydorry 4y ago
You open yourself up to a much more devastating attack vector though: sim swapping. If someone can convince the human at the other end of the line that they are you and that they lost their phone, in most countries and with most telco's, they will be able to get up and running with a new SIM with _YOUR_ number. Resettting your Authy password via SMS is then just a step away.
- avh02 4y ago
  Yeah i stopped using authy the first time a token was automatically seeded this way (may have been another way, but it was automatic and I didn't like it because I was also using the seed on my Pebble which i could then no longer do with this method). i prefer manual control over stuff like that and definitely don't want it assuming some magic is okay.
  - TedDoesntTalk 4y ago
    I think you’re being a little paranoid: https://support.authy.com/hc/en-us/articles/360036077534-Authy-Backups-Password-Recovery https://support.authy.com/hc/en-us/articles/360036077534-Aut... “How do you derive encryption keys from a Backup Password? We use the National Institute of Standards and Technology (NIST) recommended algorithm PBKDF2.”
    - avh02 4y ago
      Oh no that's fine, I just didn't like the initial seeds for a new 2fa enrollment being magically transferred to the authy app without my control/intervention. See https://authy.com/guides/twilio/ https://authy.com/guides/twilio/ and note that it's not the usual "scan the qr code". The seed is transmitted straight to authy, which, safe or not, takes away control from me to add that same seed elsewhere.
- unethical_ban 4y ago
  I don't believe you are correct. I believe an existing installation of Authy is required. >Can I reset my Backup Password? > Yes, it is possible to reset your Backup Password by tapping on Change Password in the Backup Password area of the Settings menu within the Authy app. You will have to ensure all 2FA account tokens are decrypted on your device (No red lock icons). Once a user resets their Backup Password on a device, all other devices with the Authy app for this user’s Authy account will require entering this new Backup Password. https://support.authy.com/hc/en-us/articles/360036077534-Authy-Backups-Password-Recovery https://support.authy.com/hc/en-us/articles/360036077534-Aut...
  - jimmydorry 4y ago
    https://authy.com/blog/understanding-2fa-the-authy-app-and-sms/ https://authy.com/blog/understanding-2fa-the-authy-app-and-s... The fact that they disable SMS authentication for accounts that they deem "high profile" says it all. Last time I looked, I don't recall there being a backup password (essentially a local encryption). If you SIM swap someone, you'll pull down their OTP seeds, but won't be able to read them without that code... so that's a slight improvement at least. BUT! They have a recovery process. So the risk profile is convincing the telco to SIM swap + lodging a support ticket with authy (that takes 24 hours to complete).
- jackson1442 4y ago
  You can reconfigure Authy to require an existing device to let you in as well. It won't prevent the "absolutely everything is fried" case but it's better than most password managers. If someone tries to use SMS/Voice to activate Authy on my account it just gets rejected.
  - jimmydorry 4y ago
    Pretty neat for everyone that uses two phones regularly! If you leave that other phone in your desk drawer for several years though, I wouldn't be surprised if it doesn't work...
- gtsteve 4y ago
  Authy requires a backups password to restore, or least it can be configured to. Of course, hopefully you remember it in a disaster situation. If you have a cloud password manager you can end up in a chicken and egg situation.
  - jimmydorry 4y ago
    Looks like the backup password can be reset too by support, so while that present an additional barrier to the attacker, it doesn't sound that effective.
- mst 4y ago
  I am, on the whole, more concerned about self-DoS via fire or similar disaster than I am about sim swapping. Other people's threat models will certainly differ though, and whether mine is well chosen is certainly open to question.
  - efreak 4y ago
    I've got a 2fa backup code in a DNS entry on a free hosting provider. I've got another hidden in some public source code, masquerading as an example encryption key. There's all sorts of digital hiding places these days. Self signed certificates (serial number, subject, issuer, etc), http headers, etc. Other possibilities are accounts with determinate passwords (eg. a hash of your name) that are used only to store your secrets.
- tragictrash 4y ago
  No, you need the password to decrypt your 2FA codes. There's no password for logging in. You're just incorrectly assuming how it works. https://support.authy.com/hc/en-us/articles/360036077534-What-is-a-Backup-Password-Can-it-be-recovered- https://support.authy.com/hc/en-us/articles/360036077534-Wha... >If you lose your Backup Password, you will not be able to decrypt your 2FA tokens from Twilio Authy servers and access them within the Authy app on any other device (Eg: If you bought a new phone to replace an old or lost device). If you still have access to the original device on which you set up the Authy app with your 2FA account tokens for the first time, you can follow these steps to re-configure your Authy app on a new device. Authy admins cannot reset this password. It looks like they can disable encrypted backups, but not decrypt your shit. So basically all an attacker should be able to do is gain control of your account, delete your old 2fa codes and then add his own.
  - jimmydorry 4y ago
    How does that square with their blog post about understanding the risks of using SMS [1]? >5 – 2FA Recovery >Imagine this scenario: You installed Authy, lost your phone, your laptop is broken, and the bitcoin price is climbing like crazy. You need to login to your crypto wallets, but you either enabled multi-device and all the devices with Authy are not working or accessible, and your account has been tagged high-risk, and you can’t use SMS to install a new Authy app. What are your options? >Authy has a 24-hour account recovery process. By providing your phone number to Authy Support, we can go through a set of security processes to re-enable your ability to install Authy. Some users may question why account recovery isn’t instantaneous, but our goal is to 100% protect our user’s accounts against an attack or hack, and that includes our recovery process. This 24-hour period allows us the time to perform the necessary due-diligence to verify that you are who you say you are. We’d be doing a disservice to all if we were to rush this process. [1] https://authy.com/blog/understanding-2fa-the-authy-app-and-sms/ https://authy.com/blog/understanding-2fa-the-authy-app-and-s...
    - tragictrash 4y ago
      Adding a device to your account and encrypting the tokens are distinct unreleated steps. When you enable encryption, they derive an encryption key off the passcode you provide, encrypt the tokens, then store them on authy's cloud storage. The encrypption key is never sent to authy's servers, and only stored on device. When you add a new device, you're prompted to enter the passcode, which generates an encryption key and decrypts the tokens. How is support going to decrypt the tokens for you? They need the password, which they don't have. You use support to add a device to your account, and then you use the password to decrypt your tokens. Granted, an attacker could gain access to your authy account and then delete all your tokens, but that's different from being able to log in and start using your TOTP 2fa codes. You should also have recovery codes written down somewhere in the case this happens for all your services. I literally just restarted everything from my previous post with more words.
atleta 4y ago
Google authenticator will also backup your keys to the google cloud so installing it on a new device will just work. You'll, of course, need to remember your google account password and not set it up with authenticator as the second factor. (I don't know much about authy, I only use it to access m sendgrid account, but I didn't like the fact that it used SMS for setting up or restoring an account.)
- TedDoesntTalk 4y ago
  Last i knew, Google hadn’t updated Authenticator in years. Maybe it’s a mature product and doesn’t need updating, but given Google’s history of dropping projects, I moved from Google AuthenticTor to Authy (by Twilio, an enormous company not fly-by-night)
  - atleta 4y ago
    Well, Google Authenticator uses a standard, well documented algorithm (TOTP) and there is really no reason to touch it unless they discover a security issue, it becomes incompatible with the latest version of android or there is a pressing need to improve the UX. But the UX is pretty simple. I also have Authy, because that seems to be the only one that SendGrid will work with, but exactly because of this I thought that was non-standard. But as I can see now, they probably also support standard TOTP. But they rely on SMS for initial authenticaion (when you install or re-install the app) and I don't trust that. On a side note, Microsoft also has an Authenticator app, which also supports the TOTP standard. (So it can work wherever you would use the Google Authenticator.)
    - TedDoesntTalk 4y ago
      > But they rely on SMS for initial authenticaion (when you install or re-install the app) It's been a long time since I installed it, so I'll take your word for it. They have my email address displayed in the app, so maybe I can do authentication on a new device over email, too. But regardless of how you initially authenticate a reinstall (email or SMS), as long as you are using the Authy cloud backup -- which is password-protected and cannot be reset over SMS or email -- what is your concern (genuine question)? I do not see the security risk, but I'm no expert.

tluyben2 4y ago

With 'old' banks (and other systems that use these tokens) with a physical token, you can (often?) not do that.

kalleboo 4y ago

My bank doesn't use TOTP but rather the Swedish BankID system for 2FA

jimmydorry 4y ago

You open yourself up to a much more devastating attack vector though: sim swapping. If someone can convince the human at the other end of the line that they are you and that they lost their phone, in most countries and with most telco's, they will be able to get up and running with a new SIM with _YOUR_ number. Resettting your Authy password via SMS is then just a step away.

avh02 4y ago
Yeah i stopped using authy the first time a token was automatically seeded this way (may have been another way, but it was automatic and I didn't like it because I was also using the seed on my Pebble which i could then no longer do with this method). i prefer manual control over stuff like that and definitely don't want it assuming some magic is okay.
- TedDoesntTalk 4y ago
  I think you’re being a little paranoid: https://support.authy.com/hc/en-us/articles/360036077534-Authy-Backups-Password-Recovery https://support.authy.com/hc/en-us/articles/360036077534-Aut... “How do you derive encryption keys from a Backup Password? We use the National Institute of Standards and Technology (NIST) recommended algorithm PBKDF2.”
  - avh02 4y ago
    Oh no that's fine, I just didn't like the initial seeds for a new 2fa enrollment being magically transferred to the authy app without my control/intervention. See https://authy.com/guides/twilio/ https://authy.com/guides/twilio/ and note that it's not the usual "scan the qr code". The seed is transmitted straight to authy, which, safe or not, takes away control from me to add that same seed elsewhere.
unethical_ban 4y ago
I don't believe you are correct. I believe an existing installation of Authy is required. >Can I reset my Backup Password? > Yes, it is possible to reset your Backup Password by tapping on Change Password in the Backup Password area of the Settings menu within the Authy app. You will have to ensure all 2FA account tokens are decrypted on your device (No red lock icons). Once a user resets their Backup Password on a device, all other devices with the Authy app for this user’s Authy account will require entering this new Backup Password. https://support.authy.com/hc/en-us/articles/360036077534-Authy-Backups-Password-Recovery https://support.authy.com/hc/en-us/articles/360036077534-Aut...
- jimmydorry 4y ago
  https://authy.com/blog/understanding-2fa-the-authy-app-and-sms/ https://authy.com/blog/understanding-2fa-the-authy-app-and-s... The fact that they disable SMS authentication for accounts that they deem "high profile" says it all. Last time I looked, I don't recall there being a backup password (essentially a local encryption). If you SIM swap someone, you'll pull down their OTP seeds, but won't be able to read them without that code... so that's a slight improvement at least. BUT! They have a recovery process. So the risk profile is convincing the telco to SIM swap + lodging a support ticket with authy (that takes 24 hours to complete).
jackson1442 4y ago
You can reconfigure Authy to require an existing device to let you in as well. It won't prevent the "absolutely everything is fried" case but it's better than most password managers. If someone tries to use SMS/Voice to activate Authy on my account it just gets rejected.
- jimmydorry 4y ago
  Pretty neat for everyone that uses two phones regularly! If you leave that other phone in your desk drawer for several years though, I wouldn't be surprised if it doesn't work...
gtsteve 4y ago
Authy requires a backups password to restore, or least it can be configured to. Of course, hopefully you remember it in a disaster situation. If you have a cloud password manager you can end up in a chicken and egg situation.
- jimmydorry 4y ago
  Looks like the backup password can be reset too by support, so while that present an additional barrier to the attacker, it doesn't sound that effective.
mst 4y ago
I am, on the whole, more concerned about self-DoS via fire or similar disaster than I am about sim swapping. Other people's threat models will certainly differ though, and whether mine is well chosen is certainly open to question.
- efreak 4y ago
  I've got a 2fa backup code in a DNS entry on a free hosting provider. I've got another hidden in some public source code, masquerading as an example encryption key. There's all sorts of digital hiding places these days. Self signed certificates (serial number, subject, issuer, etc), http headers, etc. Other possibilities are accounts with determinate passwords (eg. a hash of your name) that are used only to store your secrets.
tragictrash 4y ago
No, you need the password to decrypt your 2FA codes. There's no password for logging in. You're just incorrectly assuming how it works. https://support.authy.com/hc/en-us/articles/360036077534-What-is-a-Backup-Password-Can-it-be-recovered- https://support.authy.com/hc/en-us/articles/360036077534-Wha... >If you lose your Backup Password, you will not be able to decrypt your 2FA tokens from Twilio Authy servers and access them within the Authy app on any other device (Eg: If you bought a new phone to replace an old or lost device). If you still have access to the original device on which you set up the Authy app with your 2FA account tokens for the first time, you can follow these steps to re-configure your Authy app on a new device. Authy admins cannot reset this password. It looks like they can disable encrypted backups, but not decrypt your shit. So basically all an attacker should be able to do is gain control of your account, delete your old 2fa codes and then add his own.
- jimmydorry 4y ago
  How does that square with their blog post about understanding the risks of using SMS [1]? >5 – 2FA Recovery >Imagine this scenario: You installed Authy, lost your phone, your laptop is broken, and the bitcoin price is climbing like crazy. You need to login to your crypto wallets, but you either enabled multi-device and all the devices with Authy are not working or accessible, and your account has been tagged high-risk, and you can’t use SMS to install a new Authy app. What are your options? >Authy has a 24-hour account recovery process. By providing your phone number to Authy Support, we can go through a set of security processes to re-enable your ability to install Authy. Some users may question why account recovery isn’t instantaneous, but our goal is to 100% protect our user’s accounts against an attack or hack, and that includes our recovery process. This 24-hour period allows us the time to perform the necessary due-diligence to verify that you are who you say you are. We’d be doing a disservice to all if we were to rush this process. [1] https://authy.com/blog/understanding-2fa-the-authy-app-and-sms/ https://authy.com/blog/understanding-2fa-the-authy-app-and-s...
  - tragictrash 4y ago
    Adding a device to your account and encrypting the tokens are distinct unreleated steps. When you enable encryption, they derive an encryption key off the passcode you provide, encrypt the tokens, then store them on authy's cloud storage. The encrypption key is never sent to authy's servers, and only stored on device. When you add a new device, you're prompted to enter the passcode, which generates an encryption key and decrypts the tokens. How is support going to decrypt the tokens for you? They need the password, which they don't have. You use support to add a device to your account, and then you use the password to decrypt your tokens. Granted, an attacker could gain access to your authy account and then delete all your tokens, but that's different from being able to log in and start using your TOTP 2fa codes. You should also have recovery codes written down somewhere in the case this happens for all your services. I literally just restarted everything from my previous post with more words.

atleta 4y ago

Google authenticator will also backup your keys to the google cloud so installing it on a new device will just work. You'll, of course, need to remember your google account password and not set it up with authenticator as the second factor. (I don't know much about authy, I only use it to access m sendgrid account, but I didn't like the fact that it used SMS for setting up or restoring an account.)

TedDoesntTalk 4y ago
Last i knew, Google hadn’t updated Authenticator in years. Maybe it’s a mature product and doesn’t need updating, but given Google’s history of dropping projects, I moved from Google AuthenticTor to Authy (by Twilio, an enormous company not fly-by-night)
- atleta 4y ago
  Well, Google Authenticator uses a standard, well documented algorithm (TOTP) and there is really no reason to touch it unless they discover a security issue, it becomes incompatible with the latest version of android or there is a pressing need to improve the UX. But the UX is pretty simple. I also have Authy, because that seems to be the only one that SendGrid will work with, but exactly because of this I thought that was non-standard. But as I can see now, they probably also support standard TOTP. But they rely on SMS for initial authenticaion (when you install or re-install the app) and I don't trust that. On a side note, Microsoft also has an Authenticator app, which also supports the TOTP standard. (So it can work wherever you would use the Google Authenticator.)
  - TedDoesntTalk 4y ago
    > But they rely on SMS for initial authenticaion (when you install or re-install the app) It's been a long time since I installed it, so I'll take your word for it. They have my email address displayed in the app, so maybe I can do authentication on a new device over email, too. But regardless of how you initially authenticate a reinstall (email or SMS), as long as you are using the Authy cloud backup -- which is password-protected and cannot be reset over SMS or email -- what is your concern (genuine question)? I do not see the security risk, but I'm no expert.