4 ms·

So I guess the real story is that Twilio does not require second-factor authentication for employees that have access to user data? It seems like hardware-base

by sltkr 4y ago

So I guess the real story is that Twilio does not require second-factor authentication for employees that have access to user data? It seems like hardware-based 2FA with something like FIDO/U2F would have easily stopped this attack and generally make stealing credentials really difficult (it's still technically possible if you're able to spoof the target domain, but that's much harder than registering a fake domain). Kind of weird that they only mention "security training" as a remedy, which is obviously never going to be 100% effective, instead of a more effective technical solution.

Operyl 4y ago
It seems likely to me that they do, they use Authy, and the employees that fell for the attack just supplied the codes they needed. Each time you get in, you can muddle around and figure out what is needed for the next time you send out an attack until you get where you need to. The real story is that Twilio, likely due to one of their largest products being Authy, still refuses to move away from SMS 2FA. They need to finally join the rest of the industry and move on to webauthn, internally and externally for their customers.
- deleted 4y ago
  [deleted]
deleted 4y ago
[deleted]