5 ms·
My goodness, for the 100,000th time, just stop using phone numbers for 2FA. (I know you won't anyway) There are no more excuses other than asking for your phon
by rvz 2y ago
My goodness, for the 100,000th time, just stop using phone numbers for 2FA. (I know you won't anyway)
There are no more excuses other than asking for your phone to be sim-swapped and your bank accounts or your wallets to be drained by call centers.
If this breach doesn't scare you from using phone number for 2FA, then maybe nothing ever will and AI and deep fakes will make this even worse.
- AceyMan 2y agoAuthy doesn't implement SMS 2FA (how could it). A phone number is part of your user profile for registered mobile devices hosting the app.
- Justin_K 2y agoEven worse... Sounds like phone number is irrelevant, yet they collect it.
- oldmariner 2y agoHow else are they going to track people with a hard-to-change identifier?
- Terretta 2y ago> How else are they going to track people with a hard-to-change identifier? Using the device advertisee ID that the user is entitled to change. // Sorry, for a moment I thought you were serious.
- prng2021 2y agoI just did some quick research on these IDs. Correct me if I'm wrong, but it seems like each user account would be tied to one device. It also seems like the user, at least on Apple devices, has to opt into advertising tracking in order for your app to even get access to this. Ignoring the security pitfalls of phone numbers, it really doesn't seem like these advertising IDs are a drop in replacement for using phone numbers.
- jokethrowaway 2y agoIt's used to store and retrieve your 2fa secrets in case you lose your device
- Terretta 2y ago> > Even worse... Sounds like phone number is irrelevant, yet they collect it. > It's used to store and retrieve your 2fa secrets in case you lose your device The phone number doesn't store anything? But if somehow knowing that phone number is a key to getting your 2FA secrets, you'd have a bigger problem. Except it often is, and that's the problem.
- ezekg 2y agoDo what I do and turn off "allow multi-device." Problem solved -- even if your phone number is stolen, they can't recover your 2FA because it's locked to the device too.
- FabHK 2y agoYou can enable multi device, and have it on multiple devices, then disable it. https://authy.com/blog/understanding-authys-multi-device-feature/ https://authy.com/blog/understanding-authys-multi-device-fea...
- ezekg 2y agoYep. I've done this. Lots of people I know use "burner" phones without cellular for 2FA.
- rvz 2y agoThat is brilliant news for SIM swappers and criminals now that they can gain access to your codes directly with your phone number! A terrific reason to avoid anything Twilio / Authy
- deleted 2y ago[deleted]
- Ayesh 2y agoIn fairness, you cannot. It requires a backup password.
- ceejayoz 2y ago> Authy doesn't implement SMS 2FA (how could it). https://www.authy.com/integrations/ssh/ https://www.authy.com/integrations/ssh/ "Someone in your organization doesn't have a smartphone? We got you covered. Authy SSH can send them the token via SMS or a phone call."
- deleted 2y ago[deleted]
- ezekg 2y agoIf you use Authy, turn off "allow multi-device" and SIM-swapping isn't an issue. This should be on regardless of the leak.
- SketchySeaBeast 2y agoBut one of the selling points for me was to allow multiple devices so that if one broke I'd still have access.
- greenchair 2y agopeople with this use case would need to be comfortable taking on the extra risk.
- FabHK 2y agoYou can enable multi device, and have it on multiple devices, then disable it (and keep it on multiple devices - it's just that then adding yet another device needs toggling multi-device on from an existing device, a confirmation SMS is not enough).
- SketchySeaBeast 2y agoPerfect. I can just toggle it on when I add another device. Thank you, great solution.
- deleted 2y ago[deleted]
- tamimio 2y ago> for the 100,000th time, just stop using phone numbers for 2FA. I agree, and I say this to whoever asks me too, and I avoid any services that still use phone numbers as a way to associate it to you (Signal, I’m looking at ya!) However, easier said than done, some services still require you to use a phone number, like banks, some government agencies, insurance companies, etc., the services that actually matter if your data get leaked. I believe there should be a regulation to prevent using the phone in any way to confirm your ID, and never force you to provide one to access such services.
- k8sToGo 2y agoIt doesn’t scare me because in Authy you also set a password which without you cannot access the codes. The phone number here just acts as a username.