4 ms·

Twilio requires Authy for 2fa for sendgrid and maybe even twilio itself instead of supporting more standardized 2fa that’d allow 1pass to be used. This is all t

Twilio requires Authy for 2fa for sendgrid and maybe even twilio itself instead of supporting more standardized 2fa that’d allow 1pass to be used. This is all the more frustrating because I was forced to use Authy to protect an account instead of my regular tooling and they still managed to screw it up. Twilio, take a hint and stop forcing people to use your custom thing https://www.twilio.com/docs/sendgrid/ui/account-and-settings/two-factor-authentication

qingcharles 2y ago
Ugh. I hate that some apps require use of specific auth apps. This should not be a thing, we have great generic systems for this already.
- mort96 2y ago
  I just hate that some apps/services require 2FA. My 32 random characters which are unique to each service are secure enough. Adding another service on top just increases risk (as shown here; Authy was never going to do anything to protect me, but it has now leaked info about me.)
  - cqqxo4zV46cp 2y ago
    No. TOTP MFA’s mechanics make it a significant security improvement regardless of how impressively large (???) your password is. It doesn’t inherently implicate “another service”. That’s the beauty of it. This issue is SPECIFICALLY due to forced use of Authy. Forced MFA for high-value accounts is a good thing. “A long password will protect me” is 2006 thinking.
    - raincole 2y ago
      What happens when you lose your phone then? Do you have recovery code printed out? Do you carry them with you? If you do then what's the difference between this and a password?
      - tssge 2y ago
        Not the parent, but I write recovery codes down and store in a safe at my home. The difference compared to a password is that these recovery codes are single use, used only in exceptional cases and physically airgapped. On the other hand my password is multi use, is used daily by me and in the event of a breach will be exposed to the attacker. I will know if someone steals my recovery codes. I'll have no idea if someone gains knowledge of my password though.
      - qingcharles 2y ago
        I keep a second outdated Android phone secure with all my TOTP on it for now, plus I have another person I trust who I share my codes with.
    - udev4096 2y ago
      Well, phishing attacks are still prevelent and it's still at the top for compromising credentials. And phishing attacks have evolved. Most of them will hijack your session, which will make TOTP useless (FIDO will protect you tho)
      - jeromegv 2y ago
        I just don’t buy the argument that because most sophisticated attacks exist, then 2FA isn’t useful. 2FA protects you from someone getting access to a leaked password. They still can’t connect even with user and password, without doing a very elaborate hack. That’s a huge benefit.
    - Dudhbbh3343 2y ago
      > Forced MFA for high-value accounts is a good thing. No. I agree the MFA is big improvement and I use it for many of my accounts, but I still don't want you forcing me to do something "for my own good". Make it the default or show me scary warnings, but still give me the option to make my own decision in the end. Sometimes, it's okay for convenience to take precedence over security, and the user is the only one who should make that determination.
    - mort96 2y ago
      You need to explain the threat model which 2fa protects against. Because I'm not seeing it.
- pndy 2y ago
  Long story time: There's this small web portal in Poland that for years provides a simple free email service (and an instant messenger with same login) with occasional "messages from our sponsors" in your inbox - you had to tick your "interests" during registration. In time banners started to appear and that was still fine because the Web was still a pretty innocent place and tracking was years ahead of us. At some point inbox was getting flooded with spam; either one you had to have or outside the service because the domain was popular and probably addresses were scrapped from the associated instant messenger. Then, banners started to be aware of inbox content and sponsored messages included tracking - milking your habits and activity become a thing. Fast forward to some 10 years ago the service offers a premium plan where you can turn off banners around inbox, the permanent banners that pretend to be emails at the top of the list. Of course paying turns off only these banners and sponsored messages and every other spam will pile up. There's a built-in filtering option but since people started to using it to get rid of these mandatory messages - it stopped working at all. And any filter entry is a dummy one. At this point it's more an ads and spam gallery with an optional email service. Instant messenger was killed off in 2016 as people preferred global networks, and so were small but popular discussions forums turned off. Around same time portal was bought by what for year was a bigger competition to them (not the only one ofc). The idea that both portals should use a single login appears. So people saw messages at login saying that you should transfer your account to this unified platform because it's more secure and there are some "benefits". Later, a darkpattern message was displayed saying that the unified login service will be the only way to use all services including email. And this unified login comes with company's own 2FA mobile app which you can't replace with a generic generator of any kind. Aaand in the end, nothing really happens. The darkpattern messages disappear and you can still log into the email with same plain password you used for years. The 2FA becomes suddenly optional but "recommended". People complaining in Appstore reviews about login issues and fact that no generic generator works are suggested to talk with support where apparently something can be arranged. What my hot guesses are is that the company believed that domestic service popularity combined with mandatory 2FA app that does collect a lot of additional unnecessary information will provide a steady source of money for this service. People accustomed for years to an attractive short local domain won't force themselves to move elsewhere. But that didn't work as planned and honestly, I don't know how they managed to survive till today. I did created few addresses there but over the years I managed to move elsewhere; what was once cool and fast and plausible become obnoxious to use. If you remember poczta o2 you surely remember tlen emoticon: [10ton] - that's the best way to sum up what happen to this portal and service.
- mdaniel 2y ago
  Yeah, Steam get with the program My recollection is that someone reversed their algorithm and they used almost TOTP which hurts me even more because that implies that they knew about the standard and still chose violence
calderwoodra 2y ago
Even worse.. 2FA is mandatory on Twilio products, so either install authy or don't use Twilio - no exceptions.
- noman-land 2y ago
  I use a normal authenticator app which is not Authy.
- original_idea 2y ago
  Yeah, no. You don't need to use Authy.
  - slhck 2y ago
    Last time I checked, they did. In fact their 2FA system is so messed up that it thinks my mobile number is an authenticator app, and so I can't even request a code to delete the 2FA method, let alone add a new one: https://i.imgur.com/PoZ2ssc.png https://i.imgur.com/PoZ2ssc.png https://i.imgur.com/heiJer6.png https://i.imgur.com/heiJer6.png
- remram 2y ago
  I was able to use my standard app for Twilio, but didn't manage to use anything but Authy with SendGrid. Is there a trick?
original_idea 2y ago
Authy uses a standardized QR code to seed your TOTP. This isn't true.
- nloomans 2y ago
  Have you tried it? They use a proprietary integration with Authy that prevents you from using anything else. No QR code is ever provided.
- edmn 2y ago
  It's either Authy or 2FA through SMS, no other option.
- boesboes 2y ago
  Not true. Look at the documentation, authy or sms.
giancarlostoro 2y ago
They should be held fully liable for damages for this kind of nonsense when indeed it goes wrong.

qingcharles 2y ago

Ugh. I hate that some apps require use of specific auth apps. This should not be a thing, we have great generic systems for this already.

mort96 2y ago
I just hate that some apps/services require 2FA. My 32 random characters which are unique to each service are secure enough. Adding another service on top just increases risk (as shown here; Authy was never going to do anything to protect me, but it has now leaked info about me.)
- cqqxo4zV46cp 2y ago
  No. TOTP MFA’s mechanics make it a significant security improvement regardless of how impressively large (???) your password is. It doesn’t inherently implicate “another service”. That’s the beauty of it. This issue is SPECIFICALLY due to forced use of Authy. Forced MFA for high-value accounts is a good thing. “A long password will protect me” is 2006 thinking.
  - raincole 2y ago
    What happens when you lose your phone then? Do you have recovery code printed out? Do you carry them with you? If you do then what's the difference between this and a password?
    - tssge 2y ago
      Not the parent, but I write recovery codes down and store in a safe at my home. The difference compared to a password is that these recovery codes are single use, used only in exceptional cases and physically airgapped. On the other hand my password is multi use, is used daily by me and in the event of a breach will be exposed to the attacker. I will know if someone steals my recovery codes. I'll have no idea if someone gains knowledge of my password though.
    - qingcharles 2y ago
      I keep a second outdated Android phone secure with all my TOTP on it for now, plus I have another person I trust who I share my codes with.
  - udev4096 2y ago
    Well, phishing attacks are still prevelent and it's still at the top for compromising credentials. And phishing attacks have evolved. Most of them will hijack your session, which will make TOTP useless (FIDO will protect you tho)
    - jeromegv 2y ago
      I just don’t buy the argument that because most sophisticated attacks exist, then 2FA isn’t useful. 2FA protects you from someone getting access to a leaked password. They still can’t connect even with user and password, without doing a very elaborate hack. That’s a huge benefit.
  - Dudhbbh3343 2y ago
    > Forced MFA for high-value accounts is a good thing. No. I agree the MFA is big improvement and I use it for many of my accounts, but I still don't want you forcing me to do something "for my own good". Make it the default or show me scary warnings, but still give me the option to make my own decision in the end. Sometimes, it's okay for convenience to take precedence over security, and the user is the only one who should make that determination.
  - mort96 2y ago
    You need to explain the threat model which 2fa protects against. Because I'm not seeing it.
pndy 2y ago
Long story time: There's this small web portal in Poland that for years provides a simple free email service (and an instant messenger with same login) with occasional "messages from our sponsors" in your inbox - you had to tick your "interests" during registration. In time banners started to appear and that was still fine because the Web was still a pretty innocent place and tracking was years ahead of us. At some point inbox was getting flooded with spam; either one you had to have or outside the service because the domain was popular and probably addresses were scrapped from the associated instant messenger. Then, banners started to be aware of inbox content and sponsored messages included tracking - milking your habits and activity become a thing. Fast forward to some 10 years ago the service offers a premium plan where you can turn off banners around inbox, the permanent banners that pretend to be emails at the top of the list. Of course paying turns off only these banners and sponsored messages and every other spam will pile up. There's a built-in filtering option but since people started to using it to get rid of these mandatory messages - it stopped working at all. And any filter entry is a dummy one. At this point it's more an ads and spam gallery with an optional email service. Instant messenger was killed off in 2016 as people preferred global networks, and so were small but popular discussions forums turned off. Around same time portal was bought by what for year was a bigger competition to them (not the only one ofc). The idea that both portals should use a single login appears. So people saw messages at login saying that you should transfer your account to this unified platform because it's more secure and there are some "benefits". Later, a darkpattern message was displayed saying that the unified login service will be the only way to use all services including email. And this unified login comes with company's own 2FA mobile app which you can't replace with a generic generator of any kind. Aaand in the end, nothing really happens. The darkpattern messages disappear and you can still log into the email with same plain password you used for years. The 2FA becomes suddenly optional but "recommended". People complaining in Appstore reviews about login issues and fact that no generic generator works are suggested to talk with support where apparently something can be arranged. What my hot guesses are is that the company believed that domestic service popularity combined with mandatory 2FA app that does collect a lot of additional unnecessary information will provide a steady source of money for this service. People accustomed for years to an attractive short local domain won't force themselves to move elsewhere. But that didn't work as planned and honestly, I don't know how they managed to survive till today. I did created few addresses there but over the years I managed to move elsewhere; what was once cool and fast and plausible become obnoxious to use. If you remember poczta o2 you surely remember tlen emoticon: [10ton] - that's the best way to sum up what happen to this portal and service.
mdaniel 2y ago
Yeah, Steam get with the program My recollection is that someone reversed their algorithm and they used almost TOTP which hurts me even more because that implies that they knew about the standard and still chose violence

calderwoodra 2y ago

Even worse.. 2FA is mandatory on Twilio products, so either install authy or don't use Twilio - no exceptions.

noman-land 2y ago
I use a normal authenticator app which is not Authy.
original_idea 2y ago
Yeah, no. You don't need to use Authy.
- slhck 2y ago
  Last time I checked, they did. In fact their 2FA system is so messed up that it thinks my mobile number is an authenticator app, and so I can't even request a code to delete the 2FA method, let alone add a new one: https://i.imgur.com/PoZ2ssc.png https://i.imgur.com/PoZ2ssc.png https://i.imgur.com/heiJer6.png https://i.imgur.com/heiJer6.png
remram 2y ago
I was able to use my standard app for Twilio, but didn't manage to use anything but Authy with SendGrid. Is there a trick?

original_idea 2y ago

Authy uses a standardized QR code to seed your TOTP. This isn't true.

nloomans 2y ago
Have you tried it? They use a proprietary integration with Authy that prevents you from using anything else. No QR code is ever provided.
edmn 2y ago
It's either Authy or 2FA through SMS, no other option.
boesboes 2y ago
Not true. Look at the documentation, authy or sms.

giancarlostoro 2y ago

They should be held fully liable for damages for this kind of nonsense when indeed it goes wrong.