4 ms·
Instead of Google Authenticator, I use Twilio Authy. It syncs the 2FA code across my devices. I keep a backup device at home. Sure, it's not the most secure wa
by httpz 4y ago
Instead of Google Authenticator, I use Twilio Authy. It syncs the 2FA code across my devices. I keep a backup device at home.
Sure, it's not the most secure way but I trust this over carriers securing my number.
- tempestn 4y agoMe too. Although this thread is making me wonder if I'd be screwed if I somehow lost access to both of my authenticated devices. (The 'house burns down' scenario.) Edit: looks like you can fall back to SMS (along with backups password) to add a new device.
- pieter_mj 4y agoDon't use Twilio Authy. From https://raw.githubusercontent.com/blues-lab/totp-app-analysis-public/main/Gilsenan%20et%20al%20-%20Security%20and%20Privacy%20Failures%20in%20Popular%202FA%20Apps.pdf https://raw.githubusercontent.com/blues-lab/totp-app-analysi... : "the Twilio Authy app and Zoho OneAuth app each store backups on their own servers. This means that any user of Twilio Authy or Zoho OneAuth who enables cloud backups is unknowingly sending those companies the names of the websites/services they use and the usernames for their accounts on those platforms." And "By default, each of Twilio Authy, Yandex.Key, and Salesforce Authenticator also relied solely on SMS OTP to authenticate users during recovery, but did encrypt TOTP backups using a key derived from a password before uploading them to the cloud. To compromise the backup, an attacker who hijacks the phone number will still need to conduct an offline attack to guess the backup password.