News for hackers. Stuff that matters.

A comment on Getting 2FA Right in 2019. Parent comment

Re:Getting 2FA Right in 2019 by danShumway on Thursday June 20, 2019 @11:02AM (#20233582)
Just a heads up, but the last time I checked, Authy did not have secure defaults for 2FA.

Authy supports two standards -- the Google Authenticator method, and their own internal standard. Any tokens that go through their internal standard can be recovered on a new phone using just SMS verification, which defeats the entire point.

Your encryption password only applies to Google Authenticator tokens.

https://twitter.com/DanielShumway/status/1092095395478556674

[ Parent | on HN ]
Re:Getting 2FA Right in 2019 by PuffinBlue on Thursday June 20, 2019 @11:27AM (#20233857)
You are correct.

Calling them up one time the person on the phone seemed to be able to 'see' my Cloudflare TOTP code (back when cloudflare had beef with Google about their CEO account getting hacked) but wasn't able to 'see' what my manually added Google Authenticator codes were.

So I'm not even sure if Authy's own stuff is secure at all, perhaps someone from there will jump in.

But using the Google Authenticator way it's a decent option. Just be sure to treat your backup key as a critical component that needs to be stored securely.

[ Parent | on HN ]
Re:Getting 2FA Right in 2019 by latchkey on Saturday June 22, 2019 @11:00AM (#20249942)
Only if you setup SMS. Don't do that. Also, turn off the multi-device feature.

2017: https://authy.com/blog/understanding-2fa-the-authy-app-and-s...

[ Parent | on HN ]
Re:Getting 2FA Right in 2019 by Operyl on Thursday June 20, 2019 @01:52PM (#20235379)
You’re correct. I was referring the the standard TOTP here and not their weird Authy variant
[ Parent | on HN ]