[HN Gopher] Some Authy 2FA accounts were compromised in Twilio d...
___________________________________________________________________
Some Authy 2FA accounts were compromised in Twilio data breach
Author : vanburen
Score : 40 points
Date : 2022-08-27 20:35 UTC (2 hours ago)
(HTM) web link (www.engadget.com)
(TXT) w3m dump (www.engadget.com)
| Lacerda69 wrote:
| This is why we need hardened authentication services that can be
| selfhosted. Ory Kratos seems like its going in the right
| direction.
|
| proprietary auth - not even once
| kureikain wrote:
| Due to this I wrote my own tool call bima
| https://github.com/yeo/bima which use SQLite, run locally, and
| can sync encrypted blob to server.
| tiffanyh wrote:
| Very cool.
|
| Wouldn't you mind stating what license this is released under.
| Shank wrote:
| This is probably related to the fact that Authy has two modes --
| a traditional MFA mode using TOTP (6-digit codes) and another 2FA
| method using server-pushed secrets (used by Gemini, possibly
| Coinbase and others). The codes are longer than 6-digits, and
| aren't encrypted. That's when a service "enrolls" you in 2FA
| using Authy.
|
| I don't think they compromised the encrypted / non-Authy-issued
| codes.
| latchkey wrote:
| After a lot of trouble, I was able to extract my private keys
| from Authy by installing their deprecated Chrome extension and
| using some hacky javascript found in a gist. Now, I'm on the
| search for something else to load my keys into.
|
| All the other 2FA apps out there that I've looked at are lacking
| in some way or another. Ideally, I'd like as a basis: iOS and
| MacOS app (not electron) support, easy import/export, no
| requirement for a phone number, some sort of encrypted 'cloud'
| backup, open source, decent UX.
|
| I'm half tempted to just import into Bitwarden (which I happily
| pay for) and call it a day, but I'd like to keep my password
| manager separate from my 2fa... just seems awkward to combine
| them.
|
| Bueller? https://www.youtube.com/watch?v=KS6f1MKpLGM
| ok_dad wrote:
| I use Bitwarden. If someone owns my phone they'll own all my
| apps so separating factors isn't useful to me. I mostly use 2FA
| in case of a specific bug at a site that allows for something
| like a password reset attack. I use a FIDO key for the
| important stuff, including Bitwarden, so I feel like that's
| pretty good protection overall. I'll never be a target of
| anything more than common criminals, too, never a nation state
| or anyone looking for crypto or anything.
| spiffytech wrote:
| Bitwarden's 2FA support is nice because you don't have to
| jump through hoops to copy out the original secret and use it
| somewhere else.
|
| It will also automatically put the 2FA code into your
| clipboard after you autofill your password.
| krono wrote:
| Maybe worth looking into getting some Yubikeys (get a spare,
| it's just easier) and using those in combination with their 2FA
| app. They can do some other neat tricks as well with SSH and
| PGP.
|
| Clarification edit: they offer a 2FA token app which you unlock
| with your hardware key, which is separate and can be used in
| conjunction with hardware token authentication with any service
| that offers it.
|
| Note that their cheaper blue or newer biometric keys don't
| support all the same things their mainline black ones do, but
| should work just fine.
|
| No affiliation, just happy with their products and had a really
| awesome (business) customer support experience where they
| replaced several broken (through my own fault) keys for free.
| anotherhue wrote:
| I use one of these open hardware devices:
| https://www.themooltipass.com/
|
| maybe one day one of these:
| https://www.crowdsupply.com/sutajio-kosagi/precursor
| clcaev wrote:
| How does the user experience of these devices compare with
| Yubikey?
| [deleted]
| fire wrote:
| Just to note, extraction works well ( I did the same thing to
| migrate ) but services with Authy-integrated MFA ( like Twitch
| ) are "managed" by Authy so it can regenerate the secret on the
| fly and transparently to the end user, at which point your
| previously extracted secret will no longer be valid.
|
| This doesn't affect any of the MFA secrets you manually added
| to Authy, and these days many of the integrated services will
| let you additionally add standard TOTP mfa to your account (
| unfortunately Twitch still requires you to set up an Authy
| account first, though )
| OrangeMonkey wrote:
| 1password is what I use for my mfa keys. It satisfies your
| needs I think.
| JumpCrisscross wrote:
| Is it still two factor if remote actor can access the second
| factor with only your master password? (I guess they also
| need to your email, to verify a new device...)
| nvrspyx wrote:
| To add a new device, you need the email address, the master
| password, and the account key. The last one is encouraged
| to be printed out and kept in a secure, physical location.
| latchkey wrote:
| It isn't open source. There have also been numerous
| complaints about it here after they got VC investment, it
| seems to have gone down hill.
| MintDice wrote:
| CharlesW wrote:
| > _...it seems to have gone down hill._
|
| I haven't found anything better. Some people aren't happy
| with them for reasons like their subscription model and
| their move to Electron for some formerly-native clients.
|
| > _I 'm half tempted to just import into Bitwarden and call
| it a day, but I'd like to keep my password manager separate
| from my 2fa... just seems awkward to combine them._
|
| FWIW, In practice I find that this is natural and super-
| convenient.
| hangonhn wrote:
| Can someone explain the significance of this? Aren't the secrets
| suppose to be encrypted on the device side before being sent to
| the Twilio servers? I don't get how the attackers were able to
| get access to the MFA codes.
|
| Thanks.
| Aeolun wrote:
| Supposed to, yes. But clearly not, based on this article.
| scottydelta wrote:
| Does anyone knows how the hackers were able to generate auth
| codes without User's backup password to decrypt the stored keys?
| teedog wrote:
| Just migrated in bulk from Authy to Aegis Authenticator (open-
| source with encryption and automatic backups/exports).
|
| Instructions:
|
| https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d...
|
| Aegis-specific export:
|
| https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d...
| bilal4hmed wrote:
| another vote for Aegis, its fantastic but Android only.
___________________________________________________________________
(page generated 2022-08-27 23:01 UTC)