News for hackers. Stuff that matters.

A comment on Twilio Confirms Data Breach After Hackers Leak 33M Authy User Phone Numbers. Parent comment

Re:Twilio Confirms Data Breach After Hackers Leak 33M Authy ... by raincole on Thursday July 04, 2024 @10:09PM (#40879398)
What happens when you lose your phone then?

Do you have recovery code printed out? Do you carry them with you? If you do then what's the difference between this and a password?

[ Parent | on HN ]
Re:Twilio Confirms Data Breach After Hackers Leak 33M Authy ... by tssge on Thursday July 04, 2024 @10:55PM (#40879535)
Not the parent, but I write recovery codes down and store in a safe at my home.

The difference compared to a password is that these recovery codes are single use, used only in exceptional cases and physically airgapped. On the other hand my password is multi use, is used daily by me and in the event of a breach will be exposed to the attacker.

I will know if someone steals my recovery codes. I'll have no idea if someone gains knowledge of my password though.

[ Parent | on HN ]
Re:Twilio Confirms Data Breach After Hackers Leak 33M Authy ... by qingcharles on Friday July 05, 2024 @12:52PM (#40884252)
I keep a second outdated Android phone secure with all my TOTP on it for now, plus I have another person I trust who I share my codes with.
[ Parent | on HN ]