Hacker News Reader

Comment by therealmarv | Hacker News Reader

Why is Authy called unsafe by the Author and Google Authenticator safe? Ever heard that it is more likely that your smartphone gets lost, broken and stolen than your precious online account getting hacked? I'm very happy I had Authy when I was in a foreign country and my Nexus 5X stopped working (BTW: damn you LG for your poor engineering!)

View on HN

Just a few days ago I received an email from Coinbase asking to switch from Authy to Google Authenticator. The reasoning was:

> Authy and SMS are vulnerable to phone porting attacks. Device based Authenticator apps like Google Authenticator mitigate this by being linked to your device, not your phone number.

Authy is not as vulnerable as SMS to phone porting, as your TOTP secrets require a passphrase to decrypt. So even if someone ports your phone number, they'll only get your encrypted TOTP credentials.

Right. How big is the chance that somebody hacks all 3 barriers? Your password, your SMS and the TOTP passphrase?

Plus, if you do request the encrypted TOTP seeds from Authy you have a choice of 1. getting the download approved by another device already linked or 2. a 24 hour wait period during which Authy will send you an email every 6 hours.

Authy service (one where they send you SMS) is centralized. It's not that it's safe or unsafe, but generally decentralized is better option.

There have been quite a few cases where SMS authentication proved unsafe. It's gone so far as NIST recommending against SMS as a 2nd factor.

In short, providers are rather too willing to transfer a mobile phone number.

Authy also can backup your TOTP tokens (encrypted with passphrase on device). This is super handy when switching devices, but weaker than Google Auth where the TOTP private bits never go back to Google in any form.

Yes, sorry, that TOTP backup thing is great. Always hated that GAuth cannot back up.

But what was meant is the SMS service they make money on.

Reply on news.ycombinator.com