A security breach exposed two-factor authentication (2FA) codes/password reset links for millions of users on platforms like Facebook, Google, and TikTok.

Key Points:

  • YX International, an SMS routing company, left an internal database exposed online without a password.
  • The database contained one-time 2FA codes and password reset links for various tech giants.
  • YX International secured the database and claims to have “sealed the vulnerability.”
  • The company wouldn’t confirm how long the database was exposed or if anyone else accessed it.
  • Representatives from Meta, Google, and TikTok haven’t commented yet.

Concerns:

  • This leak highlights the vulnerabilities of SMS-based 2FA compared to app-based methods.
  • The lack of information regarding the leak’s duration and potential access by others raises concerns.

Gemini Recommendations:

  • Consider switching to app-based 2FA for increased security.
  • Be cautious of suspicious communications and avoid clicking unknown links.
  • Stay informed about potential security breaches affecting your online accounts.
  • kmartburrito@lemmy.world
    link
    fedilink
    English
    arrow-up
    8
    ·
    edit-2
    8 months ago

    Yep SMS two factor authentication usage was officially suggested to no longer utilize by NIST in 2016, and in practice before that, to your point.

    This shit is old, people! It’s trivial to compromise. Start transitioning where you can to passkeys and start using an app based MFA, like Duo or Authy, both free.

    • atrielienz@lemmy.world
      link
      fedilink
      English
      arrow-up
      5
      ·
      8 months ago

      My bank literally said no. I asked about using a yubikee or something like Google authenticator and they literally said, enable a pass phrase. That’s what they told me.

    • Classy@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      2
      ·
      8 months ago

      My stupid work app requires us to change our password every 6 months, no special characters so it’s harder to use PW generators, and they don’t even support 2FA. Nice that an app that stores my 401k and W-2 documents uses such amateur data security policy.