Hacker News Reader

Just a few days ago I received an email from Coinbase asking to switch from Authy to Google Authenticator. The reasoning was:

> Authy and SMS are vulnerable to phone porting attacks. Device based Authenticator apps like Google Authenticator mitigate this by being linked to your device, not your phone number.

View on HN

Authy is not as vulnerable as SMS to phone porting, as your TOTP secrets require a passphrase to decrypt. So even if someone ports your phone number, they'll only get your encrypted TOTP credentials.

Right. How big is the chance that somebody hacks all 3 barriers? Your password, your SMS and the TOTP passphrase?

Plus, if you do request the encrypted TOTP seeds from Authy you have a choice of 1. getting the download approved by another device already linked or 2. a 24 hour wait period during which Authy will send you an email every 6 hours.

Reply on news.ycombinator.com