this post was submitted on 05 Jul 2024
734 points (99.1% liked)

Technology

59446 readers
4775 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
[–] narc0tic_bird@lemm.ee 14 points 4 months ago (1 children)

Why does it require a phone number to use?!

[–] Wispy2891@lemmy.world 18 points 4 months ago (1 children)

They wanted to let companies pay for a non standard 2fa code generation tied to the phone number as it was easier than the mainstream option that was the almost abandoned google authenticator that didn't allow backups.

Cloudflare, humble bundle used that scheme and I hated them for that. Seems that now that plan failed and essentially now authy is a money-losing operation for twilio and this shows on the unsecured API access that allowed the hack

[–] Scrollone@feddit.it 4 points 4 months ago (1 children)

Also, Google Authenticator now supports backup. Aegis is another free alternative.

[–] aard@kyu.de 3 points 4 months ago (1 children)

And as soon as I learned about that I stopped using it. Turns out it was the right choice - since then more then one company had breaches where authenticator seeds extracted from a google account were used to bypass 2fa.

[–] Scrollone@feddit.it 1 points 4 months ago (1 children)

It's completely optional to connect a Google account. You can always back them up using the QR code (just take a picture with another device)

[–] todd_bonzalez@lemm.ee 1 points 4 months ago

Protip: Don't do any of this, unless you hate your accounts being secure.

An encrypted backup, and a stash of recovery codes for important accounts is the most secure way.