Hackers abused API to verify millions of Authy MFA phone numbers
www.bleepingcomputer.com
Twilio has confirmed that an unsecured API endpoint allowed threat actors to verify the phone numbers of millions of Authy multi-factor authentication users, potentially making them vulnerable to SMS phishing and SIM swapping attacks.
  • Rentlar@lemmy.caEnglish
    5·
    2 years ago

    Lol it’s taken me a while to come around to MFA (I used to hate it but I’ve started using open source MFA apps), but my hesitation to use proprietary solutions has proved smart.

  • Grumpydaddy@lemmy.worldEnglish
    3·
    2 years ago

    So for common folk like myself, what do I need to do? I used Authy for a few sites. Can a bad actor pretending to be me now get access to those sites?

  • Potatos_are_not_friends@lemmy.worldEnglish
    3·
    2 years ago

    Oh man this is going to suck.

    We were looking for an authentication setup to allow for SSO and one of the front runners was Twilio. They have a meeting with us next week and I am not looking forward to this second hand embarrassment.