Incident report: Employee and customer account compromise

Re:Incident report: Employee and customer account compromise by exabrial on Monday August 08, 2022 @11:32AM (#32386716)

Dear Twilio:

I wrote you an email a year ago about how the Authy app is dumb and SMS "2fA" is NOT a second factor! To re-iterate: SMS is not authenticated, it can be spoofed (using your platform), there are no delivery guarantees, no read receipts, it's not encrypted... and most importantly: It defers security to Phone Carriers, who have the security posture of an air seal made of swiss cheese.

Once again: Dump the Authy App. Promote actual 2fA technology like U2F, now WebAuthn, hardware keys, OR _actual_ TOTP which cannot be reset using an sms. My 67 year old Mother, grandmother of 12, knows how to use hardware keys and TOTP. I'm embarrassed for you guys that you still can't figure it out.

Sincerely,

-The I told you so department

[ Parent | on HN ]

Re:Incident report: Employee and customer account compromise by kelnos on Monday August 08, 2022 @07:09PM (#32392257)

I agree with most of what you said, but just note that TOTP does not protect against this sort of attack. Only U2F/FIDO2 does.

[ Parent | on HN ]

Re:Incident report: Employee and customer account compromise by paxys on Monday August 08, 2022 @11:33AM (#32386739)

What's wrong with the Authy app?

[ Parent | on HN ]

Re:Incident report: Employee and customer account compromise by exabrial on Monday August 08, 2022 @11:34AM (#32386754)

Your security tokens can be reset using SMS.

[ Parent | on HN ]

Re:Incident report: Employee and customer account compromise by haswell on Monday August 08, 2022 @11:42AM (#32386907)

I have only ever used the Authy app as a generic place to centralize my TOTP secrets from various services.

When you say tokens can be reset using SMS, which tokens are you referring to? Is this reset something specific to Twilio?

I can't imagine a scenario where SMS would enable the resetting of other 3rd party TOTP secrets, but I may not be understanding your comment.

[ Parent | on HN ]

Re:Incident report: Employee and customer account compromise by exabrial on Monday August 08, 2022 @11:50AM (#32387024)

Your TOTP accounts can be moved between devices using Authy, correct? That means Authy has access to the plain text secrets at some point. So mistake #1: your "secrets" aren't secret, they are merely held in escrow. If they "were evil", or perhaps if a state actor, or if you pissed a rouge employee off at Authy, they could absolutely leak your credentials.

#2: The authy app lets you recover your account using SMS. So anyone that wants to pull off a simjack attack on you can login to your Authy as you and obtain the keys to the kingdom.

The entire point of TOTP is the "Secret" is held locally in an oracle. If you break that constraint, you've broken the security of the protocol.

[ Parent | on HN ]

Re:Incident report: Employee and customer account compromise by zecaurubu on Monday August 08, 2022 @12:02PM (#32387227)

#2: I believe they encrypt the backed-up tokens locally with a user-provided password [1]. The same password must be used to restore the backup. A malicious agent that "clones" your simcard will be able to obtain only an encrypted copy of your token data. This seems secure enough for me, but maybe I'm missing something.

[1] https://authy.com/blog/how-the-authy-two-factor-backups-work...

[ Parent | on HN ]

Re:Incident report: Employee and customer account compromise by haswell on Monday August 08, 2022 @12:07PM (#32387297)

Authy has access to the secrets if someone enables cloud backups, but they're encrypted with a user-provided key that must be re-entered upon syncing to a new device.

I'm aware of the simjack risk, but that would require:

1. That I'm using cloud backups

2. That the attacker has also obtained my backup key

None of this seems fair to summarize as:

> Your security tokens can be reset using SMS.

I'm not claiming Authy is perfect, but it seems to use a reasonable approach for people who don't fall under the "high value target" category.

[ Parent | on HN ]

Re:Incident report: Employee and customer account compromise by skrtskrt on Monday August 08, 2022 @12:08PM (#32387307)

Not a huge deal but I have accounts linked to the Authy app which I no longer have access to because they're from old jobs (like a github of GSuite account) and every party involved says they cannot remove the accounts from the app, so I just have to look at these nonexistent accounts for eternity (I just switched to one of the other 19 2FA apps that have a usable interface and functionality)

[ Parent | on HN ]