Universal If you use the Authy app for 2FA codes, please read: You may be compromised.

[Apple_Robert]

“Last week, a hacker claimed to have stolen 33 million phone numbers from U.S. messaging giant Twilio. On Tuesday, Twilio confirmed to TechCrunch that “threat actors” were able to identify the phone number of people who use Authy, a popular two-factor authentication app owned by Twilio.

In a post on a well-known hacking forum, the hacker or hackers known as ShinyHunters wrote that they hacked Twilio and obtained the cell phone numbers of 33 million users.
Twilio spokesperson Kari Ramirez told TechCrunch that the company “has detected that threat actors were able to identify data associated with Authy accounts, including phone numbers, due to an unauthenticated endpoint. We have taken action to secure this endpoint and no longer allow unauthenticated requests.”

Twilio says hackers identified cell phone numbers of two-factor app Authy users | TechCrunch

Twilio says "threat actors were able to identify" phone numbers of people who use the two-factor app Authy.

techcrunch.com

I encourage you to find a new Auth 2FA app or set up.

 

[NoBoMac]

Saw this as well. Explains why, for the last few days, been getting text phishing spam. Primarily fake loan application approvals. Usually see practically zero text spam.

 

[Iwavvns]

Should we turn this into a front page article so more people will be made aware?

 

[Apple_Robert]

Saw this as well. Explains why, for the last few days, been getting text phishing spam. Primarily fake loan application approvals. Usually see practically zero text spam.

Hopefully, none of our fellow members will fall prey to this fallout. I used to use OTP Auth, which has always been excellent but, I switched most of my coding to Keychain for that aspect, for security and longevity purposes. I keep the account restore codes in Strongbox, Keychain and other backup places.

 

[Apple_Robert]

By the way, this same thing happened in 2022 as well.

Twilio says breach compromised Authy two-factor app users

Hackers gained access to the accounts of 93 Authy users and registered additional devices.

techcrunch.com

 

[Iwavvns]

By the way, this same thing happened in 2022 as well.

Twilio says breach compromised Authy two-factor app users

Hackers gained access to the accounts of 93 Authy users and registered additional devices.

techcrunch.com

Yeah, MacRumors needs to get the word out.. they do have the capability - make this a front page article.

 

[jedimasterkyle]

I'm so glad I moved away from this app but not happy that my phone number was exposed...again.

Add it to the list of hacks that we've all been a part of 🤦‍♂️...

 

[NoBoMac]

Spent a good part of the day yesterday moving off Authy. All but one account due to that requires Authy.

”Good part of the day” as I went round and round with different options until I remembered I had a lifetime license for Enpass password manager that has 2FA functions, so using it solely for 2FA and keeping my current password manager in place.

Basically, so that all my security eggs are not in one basket, no remote servers containing PII, both sync via my cloud accounts, encryption on device, and can generate backups to recover should disaster happen.

Briefly thought about iCloud Keychain for this but did not like the idea of all tied to iCloud and it being stable (seen enough sync issues on this site to not trust it enough for something this important) and no user backups. And potential for incompatibilities down the road (older device on old OS that can’t handle potentially new/improved Keychain). Worked well enough, though a little rough around the edges when compared to dedicated apps.

2FAS app is an interesting option but needs some work: does not encrypt the sync file but that is supposedly coming in next(?) major release.

 

[adrianlondon]

On the assumption that your phone number has already been obtained, if it was, then why bother moving from Authy?

The hack has been done. There's nothing they can do with Authy itself with your number, so might as well stay with them if it's what you use.

 

[NoBoMac]

why bother moving from Authy?

Just because.

Maybe a false sense of control, but does put things more under my control vs trusting some other company to not mess things up. In this case, I can sync between devices through pretty much any cloud service vs rely on Authy's cloud.

 

[NoBoMac]

News article:

https://forums.macrumors.com/threads/authy-users-urged-to-stay-alert-after-hack-exposes-33-million-phone-numbers.2430721/

 

[Iwavvns]

On the assumption that your phone number has already been obtained, if it was, then why bother moving from Authy?

The hack has been done. There's nothing they can do with Authy itself with your number, so might as well stay with them if it's what you use.

For me there would always be a question of “what other weakness will another hacker find tomorrow?”