Technology

60087 readers

4420 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 2 years ago

MODERATORS

736

Authy got hacked, and 33 million user phone numbers were stolen (appleinsider.com)

submitted 5 months ago by [email protected] to c/technology

183 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] 9point6 2 points 5 months ago (1 children)

Right, I get that and that would 100% be part of the solution, but I'm not going to have my cloud storage protected only by a single factor.

Specifically I've kinda happily landed on Authy's SMS being the 2nd factor in that scenario (and that scenario alone as it's generally one of the worst 2nd factors) because I know I can get my ESIM reprovisioned with a phone call to my provider. Plus Authy won't just give me access with an SMS alone, there are verification steps before they will let me access it, which adds piece of mind given the reduced security of an SMS OTP.

I'm not interested in cobbling together my own "secure" solution, I would happily host something ready to go (seems like bitwarden might be a front runner here), but I'm not going to trust my glue is perfect if I've had to do much more than pull a container and set-up a reverse proxy. I cannot guarantee I have the time to patch vulnerabilities manually, etc.

[–] [email protected] 2 points 5 months ago* (last edited 5 months ago)

Whoa there, I never have - and never would - suggest that anything should be protected by a single factor. Where are you getting that?

Authy sucks. It's not just that the TOTP they send you might not be secure (SMS is easily exploited), it's been shown that they're leaking other personal data.

You don't have to cobble anything together. As you say, self-hosted BitWarden is a good option. As for your "glue", you should trust it more than a third party, since you know what went into yours, and its not a massive ~~honeypot~~ treasure trove.

Edit: I've been using "honeypot" wrong. It would actually be good if the hackers tried to hack one of those.