Hacker News Reader

Comment by avian | Hacker News Reader

> Most also don't know that accounts such as Authy and other non-SMS 2FA authenticators can still be stolen if your mobile number is stolen.

I was under the impression that apps like Authy and Google Authenticator have no connection with the telephone network/phone number. Do you have any reference that claims otherwise?

View on HN

Authy specifically stores your account in the cloud and can be recovered using SMS. They have a 24 hour warning period during which the email address on file receives multiple notifications that a recovery is being attempted with the option to cancel but if someone has control over your phone number for an extended period of time they can absolutely take over your Authy account. I found this out when my Authy account was corrupted somehow and support said, hey no worries just go through the recovery process.

Google Authenticator is offline only and is not vulnerable.

Yes but your backup is encrypted by a password. So even if someone steals your number for long enough to go through recovery, they still need to be able to decrypt the backup.

>this password is not stored anywhere on Authy's servers! If you forget the password and none of your devices are synched, your tokens are lost and you will need to delete them and start over

https://support.authy.com/hc/en-us/articles/115001750008-Bac...

Storing your account in the cloud is optional with Authy at least.

I mentioned this because I know multiple people who've had authy / other authenticators compromised down the line from social engineering attacks. Even if you can be alerted, usually it's too late by the time you realize what's happened to your creds.

Did they not put a password on the Authy backup?

No that’s wrong. TOTP based 2FA is totally out of band with the only attack vectors being losing your physical device (or a device backup!) or leaking of the secret from the server side.

No that's wrong, authy backs up your TOTP seed to their server and will give them out to anyone who gains access to your authy account and can verify that they can receive sms messages sent to the number associated with the authy account. (Though they are encrypted and authy does not store the encryption keys).

That's a vulnerability of Authy's service, not TOTP.

I have some of my more important services tied to an older Yubikey. The only attack vectors for it would be on the server-side and the physical key.

Authy at least will let you "recover" your account by them sending a text message to the associated phone number. Tap the link in the message and presto, 2FA codes.

This is exactly the kind of feature you don't want...

It requires a password to decrypt the contents of the synced 2FAs.

Google Authenticator doesn’t, Authy does. That’s why you’re not supposed to use Authy for crypto.

Maybe he means phone -> google account -> android backup -> 2fa keys?

Reply on news.ycombinator.com