Will you be a victim of the Authy hack?

Available on Apple, Spotify, Amazon and more...

Summary

Authy got hacked and 30 million accounts are compromised. Phone numbers were leaked too, so SMS two-factor is a terrible idea. I’ve already moved my stuff out, and you should too: secure your email with a strong password, get a password manager, and use two-factor authentication but not via SMS.

Raw

I woke up to a report today about an app called Authy being hacked, and I think 30 million user accounts have been compromised.

Now, Authy is a two-factor authentication app where you get codes. So you scan the code, it’s in the app, and when you try to log into a service, it asks you for that code, and that code changes every 10, 20, 30 seconds or so.

Now, there is a two, they also use, I didn’t think they did, but apparently the telephone numbers of said accounts have been hacked as well, which means if you’re getting two-factor authentication via SMS, which is a really bad idea anyway, those people are really kind of screwed, basically.

Now, I’ve been changing, I change apps all the time, as you know, I’ve been changing my, um, two-factor authentication app and I was using Authy and finally enough past week I’ve been moving stuff out of it.

Luckily I don’t use SMS at all in any way for two-factor authentication. If there’s a possibility of me using it or not using it, I’d rather not use it because my email is more secure, my email account is more secure than my telephone number because someone can spoof your number. They can then get the SMS code that the app or service is sending you, and then they can access your account.

So having your email spoofed is highly impossible. It is possible, but it’s very doubtful that you can do that. But your SIM card being spoofed or your telephone are being spoofed can happen.

Anyway, back to Authy. Now, Authy is a great app. As I said, I’ve been using it for years. They stopped using a desktop app and since then I’ve been moving my two-factor authentication out of that app and now I’m on one password and it works great.

You just have to be careful of where you store your data, whether it’s client information, your information, your photos, your data is insanely important.

What’s more important, two things that are really important, is securing your email account, with an insanely hard password. Don’t create password one, two, three, or the dog’s name, or the time I went to Turkey in 2003, whatever it is. Use a proper freaking password.

So get a password manager. And the second thing is that. Just get a password manager. Make sure all your passwords are completely different. Make sure that you do use two-factor authentication when you set up your account. And then you’ll be secure and be careful of emails or SMS as a fishing attack because basically they look like the app or service or bank account that you own or you use. But in fact, they’re trying to fish information from you to be able to get into that account.

So those things are three things actually. There’s three things that are incredibly important. The main one I would say is secure an email address, email account, with a strong password. Second to that, get a password manager. Third to that is actually two-factor authentication.

So make sure you stop using Authy for now or at least get stuff out of it, change your app that you’re using for two-factor authentication, like now. And then you should be fine, and then you can sigh of relief.

Because I went through the rest of my apps in Authy today, this morning, made sure I moved everything out of it. Anything that’s in there is stuff I don’t use. Well, I haven’t used for years, so I don’t care.

So yeah, that’s what I have for you today. Be safe out there and keep it simple.