3 ms·
No, you need the password to decrypt your 2FA codes. There's no password for logging in. You're just incorrectly assuming how it works. https://support.authy.c
by tragictrash 4y ago
No, you need the password to decrypt your 2FA codes. There's no password for logging in. You're just incorrectly assuming how it works.
https://support.authy.com/hc/en-us/articles/360036077534-What-is-a-Backup-Password-Can-it-be-recovered- https://support.authy.com/hc/en-us/articles/360036077534-Wha...
>If you lose your Backup Password, you will not be able to decrypt your 2FA tokens from Twilio Authy servers and access them within the Authy app on any other device (Eg: If you bought a new phone to replace an old or lost device). If you still have access to the original device on which you set up the Authy app with your 2FA account tokens for the first time, you can follow these steps to re-configure your Authy app on a new device.
Authy admins cannot reset this password. It looks like they can disable encrypted backups, but not decrypt your shit.
So basically all an attacker should be able to do is gain control of your account, delete your old 2fa codes and then add his own.
- jimmydorry 4y agoHow does that square with their blog post about understanding the risks of using SMS [1]? >5 – 2FA Recovery >Imagine this scenario: You installed Authy, lost your phone, your laptop is broken, and the bitcoin price is climbing like crazy. You need to login to your crypto wallets, but you either enabled multi-device and all the devices with Authy are not working or accessible, and your account has been tagged high-risk, and you can’t use SMS to install a new Authy app. What are your options? >Authy has a 24-hour account recovery process. By providing your phone number to Authy Support, we can go through a set of security processes to re-enable your ability to install Authy. Some users may question why account recovery isn’t instantaneous, but our goal is to 100% protect our user’s accounts against an attack or hack, and that includes our recovery process. This 24-hour period allows us the time to perform the necessary due-diligence to verify that you are who you say you are. We’d be doing a disservice to all if we were to rush this process. [1] https://authy.com/blog/understanding-2fa-the-authy-app-and-sms/ https://authy.com/blog/understanding-2fa-the-authy-app-and-s...
- tragictrash 4y agoAdding a device to your account and encrypting the tokens are distinct unreleated steps. When you enable encryption, they derive an encryption key off the passcode you provide, encrypt the tokens, then store them on authy's cloud storage. The encrypption key is never sent to authy's servers, and only stored on device. When you add a new device, you're prompted to enter the passcode, which generates an encryption key and decrypts the tokens. How is support going to decrypt the tokens for you? They need the password, which they don't have. You use support to add a device to your account, and then you use the password to decrypt your tokens. Granted, an attacker could gain access to your authy account and then delete all your tokens, but that's different from being able to log in and start using your TOTP 2fa codes. You should also have recovery codes written down somewhere in the case this happens for all your services. I literally just restarted everything from my previous post with more words.
- jimmydorry 4y agoThen their blog post doesn't make any sense. The answer to their scenario is that the user is fucked and they are locked out of everything. >You installed Authy, lost your phone, your laptop is broken, and the bitcoin price is climbing like crazy. You need to login to your crypto wallets, but you either enabled multi-device and all the devices with Authy are not working or accessible, and your account has been tagged high-risk, and you can’t use SMS to install a new Authy app. What are your options?