Technology

59598 readers

3404 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

[email protected]

734

Authy got hacked, and 33 million user phone numbers were stolen (appleinsider.com)

submitted 4 months ago by [email protected] to c/[email protected]

179 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 11 points 4 months ago* (last edited 4 months ago) (2 children)

You can, though. But not through their app. Someone reverse engineered their protocol and wrote a program that connects like a new client, which you then approve, and it dumps all your random seeds into a text file. I then put them all into Keepass.

Edit: Unfortunately, the author has deprecated the project as Authy has added some attestations to their API, seemingly for this exact issue. https://github.com/alexzorin/authy?tab=readme-ov-file

[–] [email protected] 9 points 4 months ago (2 children)

People keep acting like Authy is betraying them by not having an export feature, but why exactly are you leaving Authy to begin with? Because they are a security risk?

You're gonna leave Authy a copy of your seeds? That defeats the purpose.

Re-key your MFA codes on the way out. Security isn't necessarily convenient.

[–] [email protected] 2 points 4 months ago (1 children)

Remind me to start a batch rekeying service.

[–] [email protected] 1 points 4 months ago (1 children)

I can't even begin to stress what a terrible idea that is. You absolutely don't want to make bulk-rekeying possible unless you like getting all of your accounts compromised at once.

[–] can 1 points 4 months ago

If there's a benefit to such a tool would bad actors have already developed one?

[–] [email protected] 1 points 4 months ago

They got rid of the desktop app.

Also, with shouldn't have your seeds. They're encrypted before they are transmitted to their servers and only decrypted on the device.

[–] [email protected] 1 points 4 months ago (1 children)

Do you know what it's called? I'd like to do this if possible.

[–] [email protected] 2 points 4 months ago

They added a link, but the project has been deprecated