News for hackers. Stuff that matters.
Re:Twilio Confirms Data Breach After Hackers Leak 33M Authy ... by cqqxo4zV46cp on Thursday July 04, 2024 @07:33PM (#40878858)
No. TOTP MFA’s mechanics make it a significant security improvement regardless of how impressively large (???) your password is. It doesn’t inherently implicate “another service”. That’s the beauty of it. This issue is SPECIFICALLY due to forced use of Authy. Forced MFA for high-value accounts is a good thing. “A long password will protect me” is 2006 thinking.
Re:Twilio Confirms Data Breach After Hackers Leak 33M Authy ... by raincole on Thursday July 04, 2024 @10:09PM (#40879398)
What happens when you lose your phone then?

Do you have recovery code printed out? Do you carry them with you? If you do then what's the difference between this and a password?

Re:Twilio Confirms Data Breach After Hackers Leak 33M Authy ... by tssge on Thursday July 04, 2024 @10:55PM (#40879535)
Not the parent, but I write recovery codes down and store in a safe at my home.

The difference compared to a password is that these recovery codes are single use, used only in exceptional cases and physically airgapped. On the other hand my password is multi use, is used daily by me and in the event of a breach will be exposed to the attacker.

I will know if someone steals my recovery codes. I'll have no idea if someone gains knowledge of my password though.

Re:Twilio Confirms Data Breach After Hackers Leak 33M Authy ... by qingcharles on Friday July 05, 2024 @12:52PM (#40884252)
I keep a second outdated Android phone secure with all my TOTP on it for now, plus I have another person I trust who I share my codes with.
Re:Twilio Confirms Data Breach After Hackers Leak 33M Authy ... by udev4096 on Thursday July 04, 2024 @11:02PM (#40879548)
Well, phishing attacks are still prevelent and it's still at the top for compromising credentials. And phishing attacks have evolved. Most of them will hijack your session, which will make TOTP useless (FIDO will protect you tho)
Re:Twilio Confirms Data Breach After Hackers Leak 33M Authy ... by jeromegv on Thursday July 04, 2024 @11:25PM (#40879622)
I just don’t buy the argument that because most sophisticated attacks exist, then 2FA isn’t useful.

2FA protects you from someone getting access to a leaked password. They still can’t connect even with user and password, without doing a very elaborate hack. That’s a huge benefit.

Re:Twilio Confirms Data Breach After Hackers Leak 33M Authy ... by Dudhbbh3343 on Thursday July 04, 2024 @11:43PM (#40879680)
> Forced MFA for high-value accounts is a good thing.

No. I agree the MFA is big improvement and I use it for many of my accounts, but I still don't want you forcing me to do something "for my own good".

Make it the default or show me scary warnings, but still give me the option to make my own decision in the end. Sometimes, it's okay for convenience to take precedence over security, and the user is the only one who should make that determination.

Re:Twilio Confirms Data Breach After Hackers Leak 33M Authy ... by mort96 on Saturday July 06, 2024 @12:48PM (#40891568)
You need to explain the threat model which 2fa protects against. Because I'm not seeing it.