Re:Incident report: Employee and customer account compromise
by haswell on Monday August 08, 2022 @12:07PM
(#32387297)
Authy has access to the secrets if someone enables cloud backups, but they're encrypted with a user-provided key that must be re-entered upon syncing to a new device.
I'm aware of the simjack risk, but that would require:
1. That I'm using cloud backups
2. That the attacker has also obtained my backup key
None of this seems fair to summarize as:
> Your security tokens can be reset using SMS.
I'm not claiming Authy is perfect, but it seems to use a reasonable approach for people who don't fall under the "high value target" category.
I'm aware of the simjack risk, but that would require:
1. That I'm using cloud backups
2. That the attacker has also obtained my backup key
None of this seems fair to summarize as:
> Your security tokens can be reset using SMS.
I'm not claiming Authy is perfect, but it seems to use a reasonable approach for people who don't fall under the "high value target" category.