A security breach exposed two-factor authentication (2FA) codes/password reset links for millions of users on platforms like Facebook, Google, and TikTok.
Key Points:
- YX International, an SMS routing company, left an internal database exposed online without a password.
- The database contained one-time 2FA codes and password reset links for various tech giants.
- YX International secured the database and claims to have “sealed the vulnerability.”
- The company wouldn’t confirm how long the database was exposed or if anyone else accessed it.
- Representatives from Meta, Google, and TikTok haven’t commented yet.
Concerns:
- This leak highlights the vulnerabilities of SMS-based 2FA compared to app-based methods.
- The lack of information regarding the leak’s duration and potential access by others raises concerns.
Gemini Recommendations:
- Consider switching to app-based 2FA for increased security.
- Be cautious of suspicious communications and avoid clicking unknown links.
- Stay informed about potential security breaches affecting your online accounts.
A lot of services now accept physical security keys for logging in. These keys use FIDO similar to how a phone-based passkey works. You just plug the dude in and then you are good to go.
Obviously not every company works with these just yet, but a lot of major companies do. Honestly most of the big tech companies support them.
GitHub and Bitwarden are the two I’m immediately thinking of, but that’s likely because I just used my passkey for those lol.
It’s way more secure than SMS MFA, and I prefer it to a phone app because I don’t have to look at then enter a code while hoping the time doesn’t run out for that code, forcing me to wait for a new one.