Twilio's Authy 2FA app has been breached.

[tabas]

Are there Authy 2FA app users here? I guess some of the users here have used this for their 2FA accounts on exchanges and wallets. Recently, there's a report that they've been breached and numbers have been taken by the hackers. So, as what the developers are warning about. The users who have registered their numbers will have to be careful of phishing and text scam attempts if they've used their mobile numbers to the app.

Twilio says someone has obtained phone numbers associated with its two-factor authentication service (2FA), Authy, as reported earlier by TechCrunch. In a security alert on Monday, Twilio warns that the “threat actors” may try to use the stolen phone numbers to carry out phishing attacks and other scams.

[...]Last week, the threat actor ShinyHunters published a list of 33 million phone numbers from Authy accounts on the dark web.[...]

Read more: Twilio alerts Authy two-factor app users that ‘threat actors’ have their phone numbers

That's a lot of numbers and Twilio confirmed that breached.  

[Z-tight]

Thanks for updating their users here, i am not an Authy app user, but their users have to be very careful of unsolicited sms's that they receive from now on. 33 million phone numbers is a lot, this is a crazy data breach; and this numbers will be sold and resold in the dark web, so there are going to be different attacks from this, especially the sim swap or simjacking attack.

[JeromeTash]

Crazy times and pretty scary too to the users of the 2-factor authentication App. I think this is a wake-up call for people to start using much better alternatives like Aegis (available only on android)
It's a bit reliving that they were not able to access all other sensitive data as per the Twilo team claims, but who knows what else they could be hiding?

[Kemarit]

I'm not a user of Authy though, but early I have heard some good reviews about it. But in any case yeah, anyone should be updating on the latest version and maybe change everything as we don't know what those scammers can do with the phone numbers that they have stolen.

I also read about this topic here: Security Alert: Update your Authy to the latest version.

So it's time to look for alternatives, many could have been using Google Authenticator or any other 2FA apps.

[logfiles]

So it's time to look for alternatives, many could have been using Google Authenticator or any other 2FA apps.

Google Authenticator is a very bad idea. I wouldn't recommend it to any one

There is this thread that has some very good open source alternatives  ----> Best 2FA applications to use. Open source, free, secure. Better than Google's. I am not sure why the topic was moved to the off-topic board despite being very informative and educated

Also, it's worth noting that andOTP Authenticator is not maintained any more, so it might not be one of the best choices available.

[TryNinja]

I started using Raivo on iOS, very recommended. Offline, no-ads, totally free, allows you to export yout accounts to a ZIP archive.

Still, I used Authy for some time and had some accounts there (even though I haven't opened the app in months because I migrated to Raivo).

[Pmalek]

One more proof that storing data in a centralized manner is very dangerous and will probably be hacked or leak at some point in the future.
I have heard Authy being recommended as an alternative to Google Authenticator a few times on the forum. To my knowledge, both software are closed-source, so not much of an alternative. If the reports are true and someone leaked over 30 million phone numbers, then the app was very popular. Social engineering schemes are to be expected... 

[Upgrade00]

Also, it's worth noting that andOTP Authenticator is not maintained any more, so it might not be one of the best choices available.

I used both andOTP and Authy back in the day, I no longer access or need any of the services that's was linked to them though. This reinforces my idea that if a service requests for personal information like email or phone numbers when you create an account, using a burner number and email is the best privacy option.

[Charles-Tim]

I started using Raivo on iOS, very recommended. Offline, no-ads, totally free, allows you to export yout accounts to a ZIP archive.

Still, I used Authy for some time and had some accounts there (even though I haven't opened the app in months because I migrated to Raivo).

I am not an iOS user but someone posted that Ravio developers has stopped developing the app. Is that true? Although, if you use it offline, I do not think that would of any problem.

best 2FA app for IOS?

Since I joined this forum, I have read on many post that Tofu is also good for iOS users. I even saw a post about it by Leo before he left this forum.

[logfiles]

I started using Raivo on iOS, very recommended. Offline, no-ads, totally free, allows you to export yout accounts to a ZIP archive.

Still, I used Authy for some time and had some accounts there (even though I haven't opened the app in months because I migrated to Raivo).

I am not an iOS user but someone posted that Ravio developers has stopped developing the app. Is that true? Although, if you use it offline, I do not think that would of any problem.

They did. In fact, the app was acquired by Mobime and things took quite a twist. I don't think it's the same app as it used to be

From the month of June, they have had so many negative reviews due to an update they messed up user OTP codes.

1. https://apps.apple.com/us/app/raivo-authenticator/id1459042137
2.RaivoOTP iPhone 2FA app sold. Latest update removes access to existing TOTP tokens
3. https://github.com/raivo-otp/ios-application/releases

4. I don't think it's open source and non-commercial any more - https://github.com/raivo-otp/marketing-website/pull/22


Well, that's how good apps get ruined overnight.

[TryNinja]

4. I don't think it's open source and non-commercial any more - https://github.com/raivo-otp/marketing-website/pull/22

That's weird. I have never seen that screen at all, even if I open the app right now there is no option to buy any pro version. Maybe it's only for new users? App is also up to date with no new versions on the app store.

[RickDeckard]

4. I don't think it's open source and non-commercial any more - https://github.com/raivo-otp/marketing-website/pull/22

That's weird. I have never seen that screen at all, even if I open the app right now there is no option to buy any pro version. Maybe it's only for new users? App is also up to date with no new versions on the app store.

Are you using iOS by any chance? The conversation on GitHub that logfiles presented has a reference where it says that the paywall isn't present (yet?) on the iOS application, so perhaps they are starting out in the Android market to see how it reacts before going into Apple market?

[PX-Z]

I'm one if their users lol. If the only concern is those future spam sms and phishing attempts it's useless, unless the security was breach to the extent that malicious attackers hold those confidential security data then i'll consider myself to migrate to other app.

Talking about to migrate, whoever have the experience of using Bitwarden, saw it as recommendation from the comments in that article posted in OP.

[RickDeckard]

I'm one if their users lol. If the only concern is those future spam sms and phishing attempts it's useless, unless the security was breach to the extent that malicious attackers hold those confidential security data then i'll consider myself to migrate to other app.

Bear in mind that this was not the first breach that Authy suffered. There have been a few already[1][2] and, to my books, more than 1 would be enough to convince me that they are not worth to have my data, let alone considering the type of service that they offer. Again, this is purely by personal opinion. The fact that you have to rely on a "non official" tool to export your 2FA codes[3][4] is just ridiculous and shows how deep they want you to be locked in to their app.

Talking about to migrate, whoever have the experience of using Bitwarden, saw it as recommendation from the comments in that article posted in OP.

I have used Bitwarden in past so if you need help just let me know and I'll try to help you.
[1]https://www.twilio.com/en-us/blog/august-2022-social-engineering-attack
[2]https://www.engadget.com/twilio-authy-data-breach-202314313.html
[3]https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d958c93
[4]https://help.ente.io/auth/migration-guides/authy/

[TryNinja]

Are you using iOS by any chance? The conversation on GitHub that logfiles presented has a reference where it says that the paywall isn't present (yet?) on the iOS application, so perhaps they are starting out in the Android market to see how it reacts before going into Apple market?

Yes, I'm on iOS.

But now that I closely check the links, I found a comment with a screenshot that looks like iOS and had the payment screen. Maybe they reverted it? https://www.reddit.com/r/apple/comments/1d402za/raivootp_iphone_2fa_app_sold_latest_update/l6cttvm/

I might just migrate everything to Bitwarden, didn't do it before because I prefer to keep my passwords and TOTP separated (I already use them as password manager), but idk...

[RickDeckard]

Are you using iOS by any chance? The conversation on GitHub that logfiles presented has a reference where it says that the paywall isn't present (yet?) on the iOS application, so perhaps they are starting out in the Android market to see how it reacts before going into Apple market?

Yes, I'm on iOS.

But now that I closely check the links, I found a comment with a screenshot that looks like iOS and had the payment screen. Maybe they reverted it? https://www.reddit.com/r/apple/comments/1d402za/raivootp_iphone_2fa_app_sold_latest_update/l6cttvm/

Whatever road that Raivo is about to follow, considering all those shady updates, for sure it will take the wrong turn. If not now, it will come eventually. Perhaps it is indeed better for you to consider another TOTP provider.

I might just migrate everything to Bitwarden, didn't do it before because I prefer to keep my passwords and TOTP separated (I already use them as password manager), but idk...

I understand your fears - if a malicious actor gains access to your Bitwarden account then he/she has total access to your accounts because both your passwords and TOTP's are generated there. Perhaps consider other open source options for the TOTP codes?

[PX-Z]

I have used Bitwarden in past so if you need help just let me know and I'll try to help you.

I actually consider moving, i already downloaded aegis and bitwarden. I remember some people here recommends using aegis as their 2fa manager. I would love to hear thoughts on those who have experienced of using of both app (aegis and bitwarden).

[tabas]

Thanks for updating their users here, i am not an Authy app user, but their users have to be very careful of unsolicited sms's that they receive from now on. 33 million phone numbers is a lot, this is a crazy data breach; and this numbers will be sold and resold in the dark web, so there are going to be different attacks from this, especially the sim swap or simjacking attack.

To be honest, I'm not sure how it works when it asks for personal mobile numbers because other 2FAs don't work like that. But still, those that have it need to be careful.

Crazy times and pretty scary too to the users of the 2-factor authentication App. I think this is a wake-up call for people to start using much better alternatives like Aegis (available only on android)
It's a bit reliving that they were not able to access all other sensitive data as per the Twilo team claims, but who knows what else they could be hiding?

Yeah, it's aegis that's being used by the reputable people here and suggesting to use it. People should avoid using Google Auth and Authy nowadays.

I'm one if their users lol. If the only concern is those future spam sms and phishing attempts it's useless, unless the security was breach to the extent that malicious attackers hold those confidential security data then i'll consider myself to migrate to other app.

Talking about to migrate, whoever have the experience of using Bitwarden, saw it as recommendation from the comments in that article posted in OP.

That seems to be the only threat but still, once these bad actors got people's numbers. They'll pass it on to the others and who knows what else they can do. As for bitwarden, I guess that I've read that in some other recommendations but haven't really used it. So aside from aegis, there goes bitwarden. I do hope that the others are reading this thread for their reference.

[RickDeckard]

I actually consider moving, i already downloaded aegis and bitwarden. I remember some people here recommends using aegis as their 2fa manager. I would love to hear thoughts on those who have experienced of using of both app (aegis and bitwarden).

I've used both and I would recommend both (be aware that Aegis is just a TOTP generator, it can't hold any passwords). Bitwarden has the possibility that you can self-host it but you have to consider what is safer : Are you able to provide a more secure environment than Bitwarden infrastructure? If you are then you should run your own version so that you are in full control. Otherwise you will just have to trust that Bitwarden will protect your encrypted vault better than you would. They use AES-CBC 256-bit encryption for your vault and PBKDF2 SHA-256 to make a derivation of your private key[1] (using 200,001 rounds both on the server side and client side) so it ends up being better than the encryption implemented by Authy (which is almost the same, but it only uses 1000 rounds[2]). The integration of the TOTP within the app works really well and if you have the browser extension running then it is a seamless experience when you are logging in to any service. Do note that you only have access to TOTP integration if you pay their premium plan - which I consider quite affordable at $10 per year - plus you'll also get 1GB of encrypted file storage and access to Bitwarden Send[3] for both text and files.

If it was me what would allow me to rest better at night would be a combination of the two - Bitwarden for my password needs and then Aegis for my TOTP needs. Like I said to TryNinja I wouldn't feel safe having all of them stored in Bitwarden - if by any random chance a malicious actor would gain access to my vault then he/she would have total control of my accounts.
[1]https://bitwarden.com/help/what-encryption-is-used/
[2]https://authy.com/blog/how-the-authy-two-factor-backups-work/
[3]https://bitwarden.com/products/send/

[Lucius]

I have never used such apps because I simply never considered them safe, just as I do not consider my smartphone to be a safe device, regardless of all the security measures. At some point, all these programs and apps, instead of preventing risks, turn into risks.