Technology

59166 readers

2125 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

735

Authy got hacked, and 33 million user phone numbers were stolen (appleinsider.com)

submitted 4 months ago by SandbagTiara2816@lemmy.dbzer0.com to c/technology@lemmy.world

178 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] maryjayjay@lemmy.world 11 points 4 months ago* (last edited 4 months ago) (2 children)

You can, though. But not through their app. Someone reverse engineered their protocol and wrote a program that connects like a new client, which you then approve, and it dumps all your random seeds into a text file. I then put them all into Keepass.

Edit: Unfortunately, the author has deprecated the project as Authy has added some attestations to their API, seemingly for this exact issue. https://github.com/alexzorin/authy?tab=readme-ov-file

[–] todd_bonzalez@lemm.ee 9 points 4 months ago (2 children)

People keep acting like Authy is betraying them by not having an export feature, but why exactly are you leaving Authy to begin with? Because they are a security risk?

You're gonna leave Authy a copy of your seeds? That defeats the purpose.

Re-key your MFA codes on the way out. Security isn't necessarily convenient.

[–] ___@lemm.ee 2 points 4 months ago (1 children)

Remind me to start a batch rekeying service.

[–] todd_bonzalez@lemm.ee 1 points 4 months ago (1 children)

I can't even begin to stress what a terrible idea that is. You absolutely don't want to make bulk-rekeying possible unless you like getting all of your accounts compromised at once.

[–] can@sh.itjust.works 1 points 4 months ago

If there's a benefit to such a tool would bad actors have already developed one?

[–] maryjayjay@lemmy.world 1 points 4 months ago

They got rid of the desktop app.

Also, with shouldn't have your seeds. They're encrypted before they are transmitted to their servers and only decrypted on the device.

[–] aliceblossom@lemmy.world 1 points 4 months ago (1 children)

Do you know what it's called? I'd like to do this if possible.

[–] AngryCommieKender@lemmy.world 2 points 4 months ago

They added a link, but the project has been deprecated