News for hackers. Stuff that matters.

A comment on Cryptocurrency investor robbed via his cellphone account sues AT&T for $224M. Parent comment

Re:Cryptocurrency investor robbed via his cellphone account ... by testvox on Thursday August 16, 2018 @01:17PM (#17776601)
No that's wrong, authy backs up your TOTP seed to their server and will give them out to anyone who gains access to your authy account and can verify that they can receive sms messages sent to the number associated with the authy account. (Though they are encrypted and authy does not store the encryption keys).
[ Parent | on HN ]
Re:Cryptocurrency investor robbed via his cellphone account ... by LyndsySimon on Thursday August 16, 2018 @03:25PM (#17777747)
That's a vulnerability of Authy's service, not TOTP.

I have some of my more important services tied to an older Yubikey. The only attack vectors for it would be on the server-side and the physical key.

[ Parent | on HN ]