3 ms·

Can someone explain the significance of this? Aren’t the secrets suppose to be encrypted on the device side before being sent to the Twilio servers? I don’t get

Can someone explain the significance of this? Aren’t the secrets suppose to be encrypted on the device side before being sent to the Twilio servers? I don’t get how the attackers were able to get access to the MFA codes. Thanks.

Aeolun 4y ago
Supposed to, yes. But clearly not, based on this article.
pards 4y ago
The Twilio exploit allowed the hackers to add a new device to existing Authy accounts. This allowed them to sync the keys between devices within the same account