4 ms·

Authy doesn't implement SMS 2FA (how could it). A phone number is part of your user profile for registered mobile devices hosting the app.

Justin_K 2y ago
Even worse... Sounds like phone number is irrelevant, yet they collect it.
- oldmariner 2y ago
  How else are they going to track people with a hard-to-change identifier?
  - Terretta 2y ago
    > How else are they going to track people with a hard-to-change identifier? Using the device advertisee ID that the user is entitled to change. // Sorry, for a moment I thought you were serious.
    - prng2021 2y ago
      I just did some quick research on these IDs. Correct me if I'm wrong, but it seems like each user account would be tied to one device. It also seems like the user, at least on Apple devices, has to opt into advertising tracking in order for your app to even get access to this. Ignoring the security pitfalls of phone numbers, it really doesn't seem like these advertising IDs are a drop in replacement for using phone numbers.
- jokethrowaway 2y ago
  It's used to store and retrieve your 2fa secrets in case you lose your device
  - Terretta 2y ago
    > > Even worse... Sounds like phone number is irrelevant, yet they collect it. > It's used to store and retrieve your 2fa secrets in case you lose your device The phone number doesn't store anything? But if somehow knowing that phone number is a key to getting your 2FA secrets, you'd have a bigger problem. Except it often is, and that's the problem.
    - ezekg 2y ago
      Do what I do and turn off "allow multi-device." Problem solved -- even if your phone number is stolen, they can't recover your 2FA because it's locked to the device too.
      - FabHK 2y ago
        You can enable multi device, and have it on multiple devices, then disable it. https://authy.com/blog/understanding-authys-multi-device-feature/ https://authy.com/blog/understanding-authys-multi-device-fea...
        ezekg 2y ago
        Yep. I've done this. Lots of people I know use "burner" phones without cellular for 2FA.
rvz 2y ago
That is brilliant news for SIM swappers and criminals now that they can gain access to your codes directly with your phone number! A terrific reason to avoid anything Twilio / Authy
- deleted 2y ago
  [deleted]
- Ayesh 2y ago
  In fairness, you cannot. It requires a backup password.
ceejayoz 2y ago
> Authy doesn't implement SMS 2FA (how could it). https://www.authy.com/integrations/ssh/ https://www.authy.com/integrations/ssh/ "Someone in your organization doesn't have a smartphone? We got you covered. Authy SSH can send them the token via SMS or a phone call."

Justin_K 2y ago

Even worse... Sounds like phone number is irrelevant, yet they collect it.

oldmariner 2y ago
How else are they going to track people with a hard-to-change identifier?
- Terretta 2y ago
  > How else are they going to track people with a hard-to-change identifier? Using the device advertisee ID that the user is entitled to change. // Sorry, for a moment I thought you were serious.
  - prng2021 2y ago
    I just did some quick research on these IDs. Correct me if I'm wrong, but it seems like each user account would be tied to one device. It also seems like the user, at least on Apple devices, has to opt into advertising tracking in order for your app to even get access to this. Ignoring the security pitfalls of phone numbers, it really doesn't seem like these advertising IDs are a drop in replacement for using phone numbers.
jokethrowaway 2y ago
It's used to store and retrieve your 2fa secrets in case you lose your device
- Terretta 2y ago
  > > Even worse... Sounds like phone number is irrelevant, yet they collect it. > It's used to store and retrieve your 2fa secrets in case you lose your device The phone number doesn't store anything? But if somehow knowing that phone number is a key to getting your 2FA secrets, you'd have a bigger problem. Except it often is, and that's the problem.
  - ezekg 2y ago
    Do what I do and turn off "allow multi-device." Problem solved -- even if your phone number is stolen, they can't recover your 2FA because it's locked to the device too.
    - FabHK 2y ago
      You can enable multi device, and have it on multiple devices, then disable it. https://authy.com/blog/understanding-authys-multi-device-feature/ https://authy.com/blog/understanding-authys-multi-device-fea...
      - ezekg 2y ago
        Yep. I've done this. Lots of people I know use "burner" phones without cellular for 2FA.

rvz 2y ago

That is brilliant news for SIM swappers and criminals now that they can gain access to your codes directly with your phone number! A terrific reason to avoid anything Twilio / Authy

deleted 2y ago
[deleted]
Ayesh 2y ago
In fairness, you cannot. It requires a backup password.

ceejayoz 2y ago

> Authy doesn't implement SMS 2FA (how could it). https://www.authy.com/integrations/ssh/ https://www.authy.com/integrations/ssh/ "Someone in your organization doesn't have a smartphone? We got you covered. Authy SSH can send them the token via SMS or a phone call."