Incident report: Employee and customer account compromise

Re:Incident report: Employee and customer account compromise by elric on Monday August 08, 2022 @02:30PM (#32389175)

That's strange. I have TOTP 2FA on my Twilio account. AFAIK there is no requirement for it to be SMS.

[ Parent | on HN ]

Re:Incident report: Employee and customer account compromise by aendruk on Monday August 08, 2022 @02:39PM (#32389274)

Twilio Support:

> We're aware that some users would much rather prefer not to use SMS for 2FA usage […] this is a known issue

> Please be noted that as of right now, you can only access [TOTP] after submitting a valid phone number. If possible, we'd recommend you just provide a personal phone number as a workaround

I’d already borrowed a coworker’s phone once for the initial account verification, but requiring it multiple times crossed a line.

[ Parent | on HN ]