News for hackers. Stuff that matters.

A comment on Cryptocurrency investor robbed via his cellphone account sues AT&T for $224M. Parent comment

Re:Cryptocurrency investor robbed via his cellphone account ... by guildenstern on Thursday August 16, 2018 @01:00PM (#17776433)
Authy specifically stores your account in the cloud and can be recovered using SMS. They have a 24 hour warning period during which the email address on file receives multiple notifications that a recovery is being attempted with the option to cancel but if someone has control over your phone number for an extended period of time they can absolutely take over your Authy account. I found this out when my Authy account was corrupted somehow and support said, hey no worries just go through the recovery process.

Google Authenticator is offline only and is not vulnerable.

[ Parent | on HN ]
Re:Cryptocurrency investor robbed via his cellphone account ... by parliament32 on Thursday August 16, 2018 @01:24PM (#17776672)
Yes but your backup is encrypted by a password. So even if someone steals your number for long enough to go through recovery, they still need to be able to decrypt the backup.

>this password is not stored anywhere on Authy's servers! If you forget the password and none of your devices are synched, your tokens are lost and you will need to delete them and start over

https://support.authy.com/hc/en-us/articles/115001750008-Bac...

[ Parent | on HN ]
Re:Cryptocurrency investor robbed via his cellphone account ... by sp332 on Thursday August 16, 2018 @02:09PM (#17777139)
Storing your account in the cloud is optional with Authy at least.
[ Parent | on HN ]
Re:Cryptocurrency investor robbed via his cellphone account ... by tessi3r on Thursday August 16, 2018 @01:13PM (#17776558)
I mentioned this because I know multiple people who've had authy / other authenticators compromised down the line from social engineering attacks. Even if you can be alerted, usually it's too late by the time you realize what's happened to your creds.
[ Parent | on HN ]
Re:Cryptocurrency investor robbed via his cellphone account ... by matwood on Thursday August 16, 2018 @02:13PM (#17777175)
Did they not put a password on the Authy backup?
[ Parent | on HN ]