4 ms·
Dear Twilio: I wrote you an email a year ago about how the Authy app is dumb and SMS "2fA" is NOT a second factor! To re-iterate: SMS is not authenticated, it
by exabrial 4y ago
Dear Twilio:
I wrote you an email a year ago about how the Authy app is dumb and SMS "2fA" is NOT a second factor! To re-iterate: SMS is not authenticated, it can be spoofed (using your platform), there are no delivery guarantees, no read receipts, it's not encrypted... and most importantly: It defers security to Phone Carriers, who have the security posture of an air seal made of swiss cheese.
Once again: Dump the Authy App. Promote actual 2fA technology like U2F, now WebAuthn, hardware keys, OR _actual_ TOTP which cannot be reset using an sms. My 67 year old Mother, grandmother of 12, knows how to use hardware keys and TOTP. I'm embarrassed for you guys that you still can't figure it out.
Sincerely,
-The I told you so department
- paxys 4y agoWhat's wrong with the Authy app?
- exabrial 4y agoYour security tokens can be reset using SMS.
- haswell 4y agoI have only ever used the Authy app as a generic place to centralize my TOTP secrets from various services. When you say tokens can be reset using SMS, which tokens are you referring to? Is this reset something specific to Twilio? I can't imagine a scenario where SMS would enable the resetting of other 3rd party TOTP secrets, but I may not be understanding your comment.
- exabrial 4y agoYour TOTP accounts can be moved between devices using Authy, correct? That means Authy has access to the plain text secrets at some point. So mistake #1: your "secrets" aren't secret, they are merely held in escrow. If they "were evil", or perhaps if a state actor, or if you pissed a rouge employee off at Authy, they could absolutely leak your credentials. #2: The authy app lets you recover your account using SMS. So anyone that wants to pull off a simjack attack on you can login to your Authy as you and obtain the keys to the kingdom. The entire point of TOTP is the "Secret" is held locally in an oracle. If you break that constraint, you've broken the security of the protocol.
- zecaurubu 4y ago#2: I believe they encrypt the backed-up tokens locally with a user-provided password [1]. The same password must be used to restore the backup. A malicious agent that "clones" your simcard will be able to obtain only an encrypted copy of your token data. This seems secure enough for me, but maybe I'm missing something. [1] https://authy.com/blog/how-the-authy-two-factor-backups-work/ https://authy.com/blog/how-the-authy-two-factor-backups-work...
- haswell 4y agoAuthy has access to the secrets if someone enables cloud backups, but they're encrypted with a user-provided key that must be re-entered upon syncing to a new device. I'm aware of the simjack risk, but that would require: 1. That I'm using cloud backups 2. That the attacker has also obtained my backup key None of this seems fair to summarize as: > Your security tokens can be reset using SMS. I'm not claiming Authy is perfect, but it seems to use a reasonable approach for people who don't fall under the "high value target" category.
- deleted 4y ago[deleted]
- skrtskrt 4y agoNot a huge deal but I have accounts linked to the Authy app which I no longer have access to because they're from old jobs (like a github of GSuite account) and every party involved says they cannot remove the accounts from the app, so I just have to look at these nonexistent accounts for eternity (I just switched to one of the other 19 2FA apps that have a usable interface and functionality)
- kelnos 4y agoI agree with most of what you said, but just note that TOTP does not protect against this sort of attack. Only U2F/FIDO2 does.