3 ms·
I use Authy’s iOS app to generate 2FA tokens for a few accounts. I cannot remember ever entering my phone number into it, or establishing an Authy account of an
by snowwrestler 2y ago
I use Authy’s iOS app to generate 2FA tokens for a few accounts. I cannot remember ever entering my phone number into it, or establishing an Authy account of any kind. Is there some other way they would have acquired my phone number?
I’m trying see if the issue is some unanticipated issue with the iOS client app itself, or if it is only affecting people who created online accounts with Authy to sync their 2FA credentials across devices.
- inhumantsar 2y agoAuthy is both a SaaS and a consumer-facing authenticator app. When companies integrate Authy into their system, they can use it for SMS OTP (also deliverable by phone call + TTS iirc) as well as regular TOTP, Authy's proprietary TOTP, and others. Your phone number would only be at risk if you used a service which used Authy for SMS 2FA
- ffsm8 2y agoThe consumer app also wants your phone number... It prompts you to "backup" your codes, so that they're not gone if you reinstall the app or switch devices you probably gave them your phone number at some point if youve got authy on multiple devices. /Edit: just checked on a clean install. It prompts for a phone number instantly and won't let you scan codes without creating an account. Not sure when that happened, as I haven't really used it in years.
- inhumantsar 2y agoFigures. I stand corrected then. We used Authy for 2FA at my last company and migrated off it to use a complete auth platform. The amount of user (consumer and business) hostile shit we found in the process was astounding. Twilio was nice to work with way back when it was the only decent API-driven POTS connection service out there. They've steadily gotten worse over the years and acquisitions though. Wouldn't recommend them to my worst enemy these days.
- razakel 2y agoYou know, one thing I learned from my patients... they all hate the phone company. It's interesting; even the stock holders of the phone company hate the phone company!
- inhumantsar 2y agoAs a former telco employee and current telco shareholder, can confirm.
- stogot 2y agoWhat do you recommend now
- inhumantsar 2y agoFor authentication services to integrate into apps/services, Zitadel. For consumer password/2FA management, Bitwarden and Yubikey.
- deleted 2y ago[deleted]
- jordigh 2y agoWhat's Authy's proprietary TOTP protocol? Is it just in fact HOTP, like Duo? https://news.ycombinator.com/item?id=20936222 https://news.ycombinator.com/item?id=20936222
- slightwinder 2y agoHave you looked into the settings? On android you can see a cellphone-number and e-mail there. If they are missing, I guess it's not known to them.
- snowwrestler 2y agoNothing in the iOS Settings app for Authy, but tapping the little gear icon in the app UI shows my phone number and email! I guess I did enter them at some point and forgot. Thanks.
- k8sToGo 2y agoIf you use cloud sync I think it requires your phone number
- toomuchtodo 2y agoCloudflare should probably deprecate their Authy provider, considering they support other more secure MFA options (hardware and virtual WebAuthN). I believe Wise (ex TransferWise) and Plastiq also use Authy natively for SMS OTP server side, but provide no mechanism to disable SMS 2FA (boo). https://authy.com/guides/cloudflare/ https://authy.com/guides/cloudflare/
- jgrahamc 2y agoThere's no "Use Authy" option any more in Cloudflare. It just says: Mobile App Authentication Secure your account with TOTP two-factor authentication. And clicking the button gives you a generic QR code to use with app of your choice.
- toomuchtodo 2y agoThank you for correcting me, Cloudflare was presented as an Authy token that would be destroyed when I deleted my Authy account and some of the docs I found led me to believe this was still actively in use. I retract the Cloudflare part of my above comment.
- jgrahamc 2y agoNo need to apologize. We did use Authy for a long time but allowed more general TOTP solutions from 2017 and have really pushed hard for people to use hardware keys.
- ayewo 2y ago> I cannot remember ever entering my phone number into it, or establishing an Authy account of any kind. Is there some other way they would have acquired my phone number? Entering your phone number was mandatory. This was what turned me away [1] from Authy to Duo Mobile on my Apple devices. https://news.ycombinator.com/item?id=33244324 https://news.ycombinator.com/item?id=33244324