Technology

Yeah. They got data in a way that was not intended. That's a hack. It's not always about subverting something by clickity-clacking like in the movies.

That's what most exploit-based hacks are. A developer makes a dumb mistake and then someone exploits it to do something they shouldn't be able to do.

I started using Authy instead of GA because every time I changed the ROM on my phone I would lose all codes, because I would forget every time.

Call my job and tell them this please. I have to use this shite everyday and it sucks.

I expect most usage of authy was based on the open TOTP protocol that Google etc use. The additional benefit was backing up those codes to the authy account, hence the avenue of attack on those accounts.

I agree though, Authy, especially since it was bought out, should be avoided. They deprecated their desktop app which was the only semi useful part of their suite, but I stopped using it years ago.

Wow, it's literally the shazam logo, flipped horizontally and red.

Wonder who got paid to make that logo?

You can, though. But not through their app. Someone reverse engineered their protocol and wrote a program that connects like a new client, which you then approve, and it dumps all your random seeds into a text file. I then put them all into Keepass.

Edit: Unfortunately, the author has deprecated the project as Authy has added some attestations to their API, seemingly for this exact issue. https://github.com/alexzorin/authy?tab=readme-ov-file

Bitwarden would be my vote

Aegis

These are not local solutions, but are cross-platform and open source: Bitwarden or Proton Pass.

Most decent password managers (e.g. 1Password, Proton Pass) have MFA built-in. Use those.

I like 1Password's built in MFA support, if it's a really sensitive account I use Google Authenticator because I haven't bothered researching better local alternative

Edit: Going to try Aegis for the more sensitive logins, looks like what I'm looking for

Most KeePass clones have it now, i use Keepass2Android plus KeePassX on PC

I use Aegis, which I periodically back up manually off phone.

Bitwarden has 2FA built in, and you can host it yourself if you want.

Aegis is often recommended as an open source solution : https://github.com/beemdevelopment/Aegis

They wanted to let companies pay for a non standard 2fa code generation tied to the phone number as it was easier than the mainstream option that was the almost abandoned google authenticator that didn't allow backups.

Cloudflare, humble bundle used that scheme and I hated them for that. Seems that now that plan failed and essentially now authy is a money-losing operation for twilio and this shows on the unsecured API access that allowed the hack

The problem is so many services requiring SMS to be that second factor. From what I've heard it's easy enough to steal a sim that if you're being explicitly targeted it's basically the same as no second factor. Yet even if using an authenticator app most services require you to still have SMS/phone as another option for the 2FA.

For Authy specifically they'd need to guess your master password and then hijack your phone number, and for users of Authy I suspect their passwords are not easily guessed as it's already a step above the standard SMS only 2FA most services require.