Twilio has confirmed that an unsecured API endpoint allowed threat actors to verify the phone numbers of millions of Authy multi-factor authentication users, potentially making them vulnerable to SMS phishing and SIM swapping attacks.
Let this be a reminder not to use Authy or Google Auth or Microsoft Auth if you can help it. Your best bet if you can help it is a Yubikey or Nitrokey. If you can’t far better to go with Aegis or Ente Auth. If you need easy sync across devices, Aegis has that, but most of the security experts I know recommend going with 1Password as your MFA solution with sync. I personally don’t trust 1Password as a for profit corporation, but I also accept I don’t get paid to know about computer security to the degree that an actual security expert is
Let this be a reminder not to use Authy or Google Auth or Microsoft Auth if you can help it. Your best bet if you can help it is a Yubikey or Nitrokey. If you can’t far better to go with Aegis or Ente Auth. If you need easy sync across devices, Aegis has that, but most of the security experts I know recommend going with 1Password as your MFA solution with sync. I personally don’t trust 1Password as a for profit corporation, but I also accept I don’t get paid to know about computer security to the degree that an actual security expert is
I’d recommend bitwarden’s dedicated 2F authentication app. The company is regularly audited and they post the results at https://bitwarden.com/help/is-bitwarden-audited/