• kitnaht@lemmy.world
    link
    fedilink
    English
    arrow-up
    191
    arrow-down
    42
    ·
    3 months ago

    ‘hacked’. Eh. There was an API endpoint left open that allowed them to basically just spam it with no rate limiting. They used the lack of a rate limit to just pull the data out of the API that it was made to produce.

    • just_another_person@lemmy.world
      link
      fedilink
      English
      arrow-up
      189
      arrow-down
      14
      ·
      3 months ago

      Yeah. They got data in a way that was not intended. That’s a hack. It’s not always about subverting something by clickity-clacking like in the movies.

      • kitnaht@lemmy.world
        link
        fedilink
        English
        arrow-up
        58
        arrow-down
        29
        ·
        edit-2
        3 months ago

        Exploit. The system worked as intended, just without a rate limit. A hack would be relying on a vulnerability in the software to make it not function as programmed.

        It’s the difference between finding a angle in a game world that causes your character to climb steeper than it should, vs rewriting memory locations to no-clip through everything. One causes the system to act in a way that it otherwise wouldn’t (SQL injections, etc) – the other, is using the system exactly as it was programmed.

        Downloading videos from YouTube isn’t “Hacking” YouTube. Even though it’s using the API in a way it wasn’t intended. Right-clicking a webpage and viewing the source code isn’t hacking - even if the website you’re looking at doesn’t want you looking at the source.

          • ___@lemm.ee
            link
            fedilink
            English
            arrow-up
            2
            ·
            3 months ago

            A system fault is not the same as a vulnerability. These would have different baseline CVSS 3.1 scores, with the temporal and environmental reducing over time. A medium/low at best for a public endpoint exposing PII.

        • Natanael@slrpnk.net
          link
          fedilink
          English
          arrow-up
          2
          arrow-down
          1
          ·
          3 months ago

          Hacking is the entire process including figuring out if something is or is not rare limited

        • just_another_person@lemmy.world
          link
          fedilink
          English
          arrow-up
          10
          arrow-down
          13
          ·
          3 months ago

          Sure. Except you’re wrong and have absolutely idea of what people in this community say about things. Let me be a dick and literally googz this for you and find an embarassing answer because you couldn’t do it yourself.

              • stephen01king@lemmy.zip
                link
                fedilink
                English
                arrow-up
                4
                ·
                3 months ago

                But they are using a loophole to gain sensitive data. They did not gain unauthorised access to the system.

                • Guest_User@lemmy.world
                  link
                  fedilink
                  English
                  arrow-up
                  2
                  arrow-down
                  1
                  ·
                  3 months ago

                  They absolutely gained unauthorized access to the data. Their access was not intended or sanctioned. If it was intended to be public and accessible like it was, this wouldn’t be a story and they wouldn’t have locked down the access.

        • 0xD@infosec.pub
          link
          fedilink
          English
          arrow-up
          2
          arrow-down
          5
          ·
          3 months ago

          A missing rate limit is a vulnerability, or a weakness, depending on the definition. You’re playing smart without having an idea of what you’re talking about. Here you go:

          https://cwe.mitre.org/data/definitions/799.html

          YouTube videos are public, and as such it’s not really hacking. If you were able to download private videos, for example, it would be a vulnerability like “Improper Access Control”. It does not matter in the least whether you use an “exploit” in your definition (which is wrong) or “just increment the video ID”.

          The result is a breach of confidentiality, and as such this is to be classified as a “hack”.

      • NateNate60@lemmy.world
        link
        fedilink
        English
        arrow-up
        18
        arrow-down
        11
        ·
        3 months ago

        With due respect, you are wrong.

        hack

        1. (transitive, slang, computing) To hack into; to gain unauthorized access to (a computer system, e.g., a website, or network) by manipulating code

        Hacking means gaining unauthorized access to a computer system by manipulating or exploiting its code.

        Wiktionary

          • NateNate60@lemmy.world
            link
            fedilink
            English
            arrow-up
            8
            arrow-down
            9
            ·
            3 months ago

            They did not do it by manipulating code. This wasn’t the result of a code vulnerability. If you leave the door wide open with all your stuff out for the entire neighbourhood to see, you can’t claim you were “broken into”. Similarly, if you don’t secure your endpoints, you can’t claim you were “hacked”.

            • sudneo@lemm.ee
              link
              fedilink
              English
              arrow-up
              9
              ·
              3 months ago

              Lack of rate limiting is a code vulnerability if we are talking about an API endpoint.

              Not that discussion makes any sense at all…

              Also, “not securing” doesn’t mean much. Security is not a boolean. They probably have some controls, but they still have a gap in the lack of rate limiting.

              • NateNate60@lemmy.world
                link
                fedilink
                English
                arrow-up
                3
                arrow-down
                2
                ·
                3 months ago

                It is a vulnerability, but exploiting that vulnerability is not generally considered by security experts to be “hacking” in the usual meaning of that term in academic settings. Using an open or exposed API, even one with a sign that says “don’t abuse me”, is generally not considered hacking.

                • sudneo@lemm.ee
                  link
                  fedilink
                  English
                  arrow-up
                  5
                  ·
                  3 months ago

                  I am a security professional. I would personally not care less to make the distinction, as both are very generic terms that are used very liberally in the industry.

                  So I don’t see any reason not to call this hacking. This was not an intended feature. It was a gap, which has been used to perform things that the application writer did not intended (not in this form). If fits with the definition of hacking as far as I can tell. In any case, this is not an academic discussion, it is a security advisory or an article that talks about it.

              • NateNate60@lemmy.world
                link
                fedilink
                English
                arrow-up
                9
                arrow-down
                3
                ·
                3 months ago

                Please provide a link to whatever source claims this.

                I hold a computer science degree and this contradicts the definition of “hack” versus “exploit” used in academic settings.

        • kitnaht@lemmy.world
          link
          fedilink
          English
          arrow-up
          8
          arrow-down
          8
          ·
          edit-2
          3 months ago

          Hint – by manipulating or exploiting its code

          Which I am explaining, they…did…not…do…

          They did nothing to the code. They didn’t break the code, they didn’t cause the code to do anything it wasn’t designed to do. They did not exploit any code. They used an API endpoint that was in the open. For its intended purpose, to verify phone numbers. The api verified phone numbers, they verified phone numbers with the api. The only thing they did here…was they did verification on a lot of phone numbers.

          • Guest_User@lemmy.world
            link
            fedilink
            English
            arrow-up
            4
            ·
            3 months ago

            They absolutely exploited unintended functionality. If this was intended, they wouldn’t have added rate limiting and locked down the api after. It was clear to say this was certainly not an intended use of the api.

            In a video game for example, if there is a an item that caused excessive lagging just by placing the item. Placing a lot of them with the intent to lag the game would be an exploit. They only used items sanctioned by the game, but for unintended reasons and they would likely be banned for exploitation.

    • Cornelius_Wangenheim@lemmy.world
      link
      fedilink
      English
      arrow-up
      37
      arrow-down
      1
      ·
      edit-2
      3 months ago

      That’s what most exploit-based hacks are. A developer makes a dumb mistake and then someone exploits it to do something they shouldn’t be able to do.

  • Scrollone@feddit.it
    link
    fedilink
    English
    arrow-up
    110
    arrow-down
    1
    ·
    3 months ago

    Companies need to stop using Authy. It’s stupid and pointless when we have a open alternative such as the one used by Google Authenticator or Aegis.

    • TheEighthDoctor@lemmy.world
      link
      fedilink
      English
      arrow-up
      50
      arrow-down
      7
      ·
      3 months ago

      I started using Authy instead of GA because every time I changed the ROM on my phone I would lose all codes, because I would forget every time.

      • Lem453@lemmy.ca
        link
        fedilink
        English
        arrow-up
        49
        ·
        3 months ago

        Use aegis, export the keys and then reimport them every time you switch. Trusting your second factor to a cloud is a disaster waiting to happen.

        If you want to get fancy setup your own cloud server (nextcloud, Seafile, owncloud etc) and set the backup folder for aegis to the self hosted cloud for easy restore every time you switch ROMs.

        • ruse8145@lemmy.sdf.org
          link
          fedilink
          English
          arrow-up
          1
          ·
          3 months ago

          Simpler approach: auto export from aegis when an update occurs, syncthing or similar to your home PC. I have it synced across several computer in different locations and aegis is good enough to make unique filenames, combine with syncthing file history and I’m good for like 2 years of backups.

      • dev_null@lemmy.ml
        link
        fedilink
        English
        arrow-up
        13
        ·
        3 months ago

        GA now backups your codes in your Google account, so this doesn’t happen anymore.

        • ruse8145@lemmy.sdf.org
          link
          fedilink
          English
          arrow-up
          2
          ·
          3 months ago

          They had an obvious solution which is export to an encrypted text files and went with the option that lowers your security

          • dev_null@lemmy.ml
            link
            fedilink
            English
            arrow-up
            2
            ·
            3 months ago

            Google usually goes with the lowest common denominator solution. There is a staggering amount of people who don’t know what is a file, let alone that phones have any.

      • laurelraven@lemmy.blahaj.zone
        link
        fedilink
        English
        arrow-up
        2
        ·
        3 months ago

        I’ve started putting mine into my Bitwarden vault as well as Google auth, mainly because I’m a bit paranoid I’ll wind up locked out of something by trusting a second factor too much

        • Coreidan@lemmy.world
          link
          fedilink
          English
          arrow-up
          1
          arrow-down
          1
          ·
          3 months ago

          With password recovery you shouldn’t be getting locked out of anything. I don’t see this being a risk.

    • lazynooblet@lazysoci.al
      link
      fedilink
      English
      arrow-up
      17
      ·
      3 months ago

      I expect most usage of authy was based on the open TOTP protocol that Google etc use. The additional benefit was backing up those codes to the authy account, hence the avenue of attack on those accounts.

      I agree though, Authy, especially since it was bought out, should be avoided. They deprecated their desktop app which was the only semi useful part of their suite, but I stopped using it years ago.

  • ugjka@lemmy.world
    link
    fedilink
    English
    arrow-up
    69
    arrow-down
    2
    ·
    3 months ago

    I realized long time ago that I don’t want my 2FA be tied to my phone number. And then i found you can’t export your data from Authy because they know they are scummy fucks and don’t want to anyone to leave

    • maryjayjay@lemmy.world
      link
      fedilink
      English
      arrow-up
      11
      ·
      edit-2
      3 months ago

      You can, though. But not through their app. Someone reverse engineered their protocol and wrote a program that connects like a new client, which you then approve, and it dumps all your random seeds into a text file. I then put them all into Keepass.

      Edit: Unfortunately, the author has deprecated the project as Authy has added some attestations to their API, seemingly for this exact issue. https://github.com/alexzorin/authy?tab=readme-ov-file

      • Todd Bonzalez@lemm.ee
        link
        fedilink
        English
        arrow-up
        10
        arrow-down
        1
        ·
        3 months ago

        People keep acting like Authy is betraying them by not having an export feature, but why exactly are you leaving Authy to begin with? Because they are a security risk?

        You’re gonna leave Authy a copy of your seeds? That defeats the purpose.

        Re-key your MFA codes on the way out. Security isn’t necessarily convenient.

          • Todd Bonzalez@lemm.ee
            link
            fedilink
            English
            arrow-up
            2
            arrow-down
            1
            ·
            3 months ago

            I can’t even begin to stress what a terrible idea that is. You absolutely don’t want to make bulk-rekeying possible unless you like getting all of your accounts compromised at once.

            • can@sh.itjust.works
              link
              fedilink
              English
              arrow-up
              1
              ·
              3 months ago

              If there’s a benefit to such a tool would bad actors have already developed one?

        • maryjayjay@lemmy.world
          link
          fedilink
          English
          arrow-up
          1
          ·
          3 months ago

          They got rid of the desktop app.

          Also, with shouldn’t have your seeds. They’re encrypted before they are transmitted to their servers and only decrypted on the device.

      • canadaduane@lemmy.ca
        link
        fedilink
        English
        arrow-up
        20
        ·
        edit-2
        3 months ago

        On Android, I replaced Authy with the open-source Aegis app. It’s just as functional, allows exporting, and doesn’t tie your data to your phone number (nor store it on a central system–not sure if Authy does this or not).

      • Contravariant@lemmy.world
        link
        fedilink
        English
        arrow-up
        11
        ·
        3 months ago

        Use TOTP wherever possible. It’s standardized, and typically can be found somewhere if you keep digging hard enough.

        Plenty of services push their own proprietary systems hard though. Looking at you M$

        • Tryptaminev@lemm.ee
          link
          fedilink
          English
          arrow-up
          3
          ·
          3 months ago

          I also find this infuriating. I had a service offer TOTP for authentication. Installed an open source TOTP Aap, scanned the QR and voila.

          The service meanwhile can control whether they want to generate a new token or give out the old one again, for instance when a device was lost.

          It is the most easy, most convenient solution both for the service provider and the client. There is no excuse for any other 2FA system to be used.

    • Gestrid@lemmy.ca
      link
      fedilink
      English
      arrow-up
      6
      arrow-down
      2
      ·
      edit-2
      3 months ago

      then i found you can’t export your data from Authy

      Exporting data from a 2FA app sounds like the opposite of secure. Not to mention you don’t want your 2FA codes on Authy (or any other 2FA app) to remain valid if you’re not using it.

      When I switched from Google Authenticator to Authy years ago, I went through each 2FA-enabled account one by one to disable 2FA and then re-enable it using Authy. It’s a long process depending on how many accounts you have 2FA enabled on, but it’s worth it.

      Reading the OP, looks like it’s time to generate new keys for all my 2FA accounts.

      • fine_sandy_bottom
        link
        fedilink
        English
        arrow-up
        4
        ·
        3 months ago

        If you can’t export / save / transfer codes then you need to regenerate all your 2fa codes every time you switch to a new device.

        2FA doesn’t need to be infallible, it just needs to be a second factor.

    • Srootus@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      3
      ·
      edit-2
      3 months ago

      I used this method to export my twitch 2FA to Aegis. although I did this a few years ago, I think it still works

      Edit: reading though comments made me realise Authy’s desktop app doesnt seem to be a thing anymore, so sadly I dont think it works anymore

      • can@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        1
        ·
        3 months ago

        Wow, that was one of the things that drew it to me in the first place. I break phones too frequently to feel comfortable leaving everything to them.

  • net00@lemm.ee
    link
    fedilink
    English
    arrow-up
    28
    ·
    3 months ago

    Now that authy has fucked us over with this, what should I move my 2fa codes into, any recommendations?

    Unfortunately I can’t use aegis on iOS/windows, does keepass have this functionality?

      • kahdbrixk@feddit.de
        link
        fedilink
        English
        arrow-up
        10
        ·
        3 months ago

        Just out of curiosity: is it wise to keep you MFA within your password safe? Like is that not the opposite of multi factor? I’m no troll, I’m seriously uninformed.

        • AProfessional@lemmy.world
          link
          fedilink
          English
          arrow-up
          10
          ·
          edit-2
          3 months ago

          Realistically the threat we care about is others leak your password. So it doesn’t matter.

          If you have a setup where your password vault is at risk then yes it’s a bad idea.

        • CaptPretentious@lemmy.world
          link
          fedilink
          English
          arrow-up
          7
          arrow-down
          1
          ·
          3 months ago

          I suppose there is a certain level of risk but that’s true with any solution. Passwords generally don’t get changed very often and that’s usually what’s going to be nabbed up by somebody that in your username of course. With TOTP, putting that in bitwarden means that in order to get access to whatever account, they first have to get your credentials which they probably got from a dump filled with a bunch of other credentials, then I’d have to figure out that you’re using bitwarden was your be no sign that you are. Then they’d have to actually get into your bitwarden which if you’re doing it properly should be difficult. And if the login to bitwarden is completely different than the account are trying to get into it’s basically invisible to them.

          The only way I see bitwarden being the weak link, is 1. Someone has physical access to your devices and they know what they’re looking for (in this case it’s probably a roommate or family or friend, someone that you trust but probably shouldn’t). 2. Bitwarden gets compromised (which is an impossible but it is probably more difficult because it is an open source thing). 3. You go to shady website and install shady stuff and that install some sort of keylogger, or something else that shows what your system has (hell, Microsoft recall would actually fall into this category) and a back actor sees that you have bitwarden and how you log into it. But that being said, 1 and 3 aren’t necessarily stopped by having a password manager solution and the separate MFA solution… But it could slow them down.

          But physical MFA isn’t impervious either. I don’t recall if it was yubiki or Google’s Titan, if I remember back years ago one of them had a problem.

      • riplin@lemm.ee
        link
        fedilink
        English
        arrow-up
        10
        ·
        3 months ago

        I’ve been running a self-hosted Vaultwarden server with Bitwarden clients. It’s been perfect. The clients could use some usability work, but other than that, no complaints.

    • snek_boi@lemmy.ml
      link
      fedilink
      English
      arrow-up
      17
      ·
      3 months ago

      These are not local solutions, but are cross-platform and open source: Bitwarden or Proton Pass.

      • lud@lemm.ee
        link
        fedilink
        English
        arrow-up
        7
        ·
        3 months ago

        Doesn’t synced solutions completely defeat the purpose of MFA?

        • JasonDJ@lemmy.zip
          link
          fedilink
          English
          arrow-up
          12
          ·
          edit-2
          3 months ago

          Not if you protect the master key with MFA, like a yubikey. Then it’s cryptographically secure for quite a while…at least until quantum computing is affordable enough to be used against your data. Or the database and your yubikey and yourbpassphrase are compromised

        • snek_boi@lemmy.ml
          link
          fedilink
          English
          arrow-up
          1
          ·
          3 months ago

          You’ve got a good point. I wonder if this an example of a trade-off between convenience and security. If you’re logging in and you get an MFA prompt, a Yubikey has to be physically searched, while Bitwarden or Proton Pass only have to be clicked. A Yubikey can only hold a limited amount of accounts, while Bitwarden or Proton Pass could hold many more. Of course, a Yubikey could be used as MFA for Bitwarden or Proton Pass, but that would create a single point of failure and reduce factor separation (which I think is your original point).

          While I posted a Bitwarden or Proton Pass recommendation of sorts, I genuinely wonder if it’s advisable to not use MFA at all if the factors will not be separated. Or, perhaps, the best security solution is the one you’ll actually use. I guess the answer is the good ol’ “What’s your security model?”

          • Passerby6497@lemmy.world
            link
            fedilink
            English
            arrow-up
            1
            ·
            3 months ago

            I wonder if this an example of a trade-off between convenience and security.

            I genuinely wonder if it’s advisable to not use MFA at all if the factors will not be separated. Or, perhaps, the best security solution is the one you’ll actually use

            Your first and last statements are correct. Using your password manager as your MFA is a trade off with security and convenience, but that added convenience helps make it more usable so you actually use it. Anything is a trade up for most peoples’ awful password hygiene, so the trade off is worth it in my opinion.

            Regarding the advisability of combining password and MFA into one platform: while you are lowering the overall security of your accounts, if you secure the main account with a long/strong password and a hardware security key, I would say that’s still more secure than not having 2FA enabled or not using secure passwords.

    • padge@lemmy.zip
      link
      fedilink
      English
      arrow-up
      8
      ·
      edit-2
      3 months ago

      I like 1Password’s built in MFA support, if it’s a really sensitive account I use Google Authenticator because I haven’t bothered researching better local alternative

      Edit: Going to try Aegis for the more sensitive logins, looks like what I’m looking for

        • padge@lemmy.zip
          link
          fedilink
          English
          arrow-up
          1
          ·
          3 months ago

          Possibly not now that it saves your codes to your google account (it didn’t use to), but it made me uncomfortable for my password manager to have both factors together to log into something like my bank or root AWS account. So you’d have to compromise two different places to get in

    • Veraxus@lemmy.world
      link
      fedilink
      English
      arrow-up
      8
      ·
      3 months ago

      Most decent password managers (e.g. 1Password, Proton Pass) have MFA built-in. Use those.

    • Natanael@slrpnk.net
      link
      fedilink
      English
      arrow-up
      9
      arrow-down
      1
      ·
      3 months ago

      Most KeePass clones have it now, i use Keepass2Android plus KeePassX on PC