Some Authy 2FA accounts were compromised in Twilio data breach

Re:Some Authy 2FA accounts were compromised in Twilio data b... by slowbdotro on Saturday August 27, 2022 @07:13PM (#32624171)

Technically yes, but from memory, your U2F public key would be leaked. Thus depending on your threat model you may still want to rotate U2F keys.

[ Parent | on HN ]

Re:Some Authy 2FA accounts were compromised in Twilio data b... by quickcheck on Saturday August 27, 2022 @07:47PM (#32624385)

I thought ‘public’ means it can be shared widely without there being a risk to the private key. What threat model would consider it a risk to have a public key exposed?

[ Parent | on HN ]

Re:Some Authy 2FA accounts were compromised in Twilio data b... by password4321 on Saturday August 27, 2022 @10:07PM (#32625098)

Identity/privacy: de-anonymizing accounts reusing the same public key.

[ Parent | on HN ]

Re:Some Authy 2FA accounts were compromised in Twilio data b... by lazka on Sunday August 28, 2022 @02:18AM (#32626216)

U2F generates a new keypair for each origin. Public keys are not re-used.

[ Parent | on HN ]