News for hackers. Stuff that matters.

A comment on Authy: Faster Two-Factor Authentication. Parent comment

Re:Authy: Faster Two-Factor Authentication by mseebach on Wednesday July 31, 2013 @11:28AM (#6134405)
> 1. Authy tokens automatically sync even if you lose, change or upgrade phone.

So the tokens are stored on Authy's servers? Doesn't that defeat the purpose of two-factor? How do I (or an attacker) recover my tokens if I loose my phone?

[ Parent | on HN ]
Re:Authy: Faster Two-Factor Authentication by chimeracoder on Wednesday July 31, 2013 @12:44PM (#6135040)
You're correct - there are serious security concerns with Authy's product, which were pointed out on an earlier HN thread: https://news.ycombinator.com/item?id=4916983

Personally, I'd be concerned with trusting my credentials with any company unless all members of the leadership team (yes, including "nontech" people) are incredibly familiar with basic security terminology and practices.

(Note that the founder is unclear when PBKDF2 and AES are being used in the product, which is concerning, because they have very different use cases and should be hard to confuse).

[ Parent | on HN ]