A security breach exposed two-factor authentication (2FA) codes/password reset links for millions of users on platforms like Facebook, Google, and TikTok.

Key Points:

  • YX International, an SMS routing company, left an internal database exposed online without a password.
  • The database contained one-time 2FA codes and password reset links for various tech giants.
  • YX International secured the database and claims to have “sealed the vulnerability.”
  • The company wouldn’t confirm how long the database was exposed or if anyone else accessed it.
  • Representatives from Meta, Google, and TikTok haven’t commented yet.

Concerns:

  • This leak highlights the vulnerabilities of SMS-based 2FA compared to app-based methods.
  • The lack of information regarding the leak’s duration and potential access by others raises concerns.

Gemini Recommendations:

  • Consider switching to app-based 2FA for increased security.
  • Be cautious of suspicious communications and avoid clicking unknown links.
  • Stay informed about potential security breaches affecting your online accounts.
  • ozymandias117@lemmy.world
    link
    fedilink
    English
    arrow-up
    58
    arrow-down
    1
    ·
    8 months ago

    App-based is also unacceptable if it’s a proprietary implementation

    TOTP/HOTP are the best standards right now

      • ozymandias117@lemmy.world
        link
        fedilink
        English
        arrow-up
        18
        ·
        8 months ago

        Yeah, Yubikey fits - it implements TOTP/HOTP, and bitwarden is great

        Just “app-based” worried me about apps rolling their own implementations instead of using standards

    • Rolling Resistance@lemmy.world
      link
      fedilink
      English
      arrow-up
      4
      arrow-down
      1
      ·
      8 months ago

      Have you ever used HOTP before? Convenience-wise, it’s much worse than TOTP. It’s not supported by popular apps, you can’t use it on several devices unless there’s synchronization, you never know if the code you’re looking at was used already.

      • ozymandias117@lemmy.world
        link
        fedilink
        English
        arrow-up
        3
        ·
        8 months ago

        Yeah, it’s much less convenient. I prefer TOTP, but I will pick HOTP over Cisco Duo’s proprietary implementation that I can’t use without their specific app if those are my only options