I was just reading over the medium article about the guy who lost 8k$ BTC from a hacker who took over his cell # account with Verizon. I thought to myself well hey if he had Authy 2FA this vector of attack would have failed. Upon looking into that a bit more I realized I was wrong. BY DEFAULT Authy allows any mobile device with access to the phone number associated to the Authy account to download and access the private keys for that account. IE if you gain access to someones phone through Sprint / Verizon, Authy 2FA by default will do nothing to protect your accounts. If you were to ask me before I checked into this I would have been 100% sure that Authy would require the Master Password for the account to add additional devices. That is definitely not the case. Obviously the hacker would need to crack / know the associated passwords for whatever account they are trying to access but the 2FA in this scenario becomes absolutely useless.
I personally think this is an ENORMOUS security flaw in Authy design to have this feature on by default. Digging a bit more I discovered you are able to turn it off within the Authy mobile app by going to Settings > Devices > and TURN OFF "Allow Multi-device". Turning this feature off will only stop ADDITIONAL devices from adding themselves to your Authy account via the related cell phone # so add any of your own legit devices first before turning it off. All additional devices previously added will remain active.
Again I can't believe this feature stays on by default and thank you for the guy who wrote that article otherwise I would never have looked deeper into my own security and discovered this potentially fatal vector of attack. Since it would seem Sprint / Verizon don't give a shit about your cell # security it would be prudent to consider them a non-existent layer of defense. Assume that any hacker already has access to your cell number and plan your security around that knowledge.
I would implore anyone using Authy 2FA to turn off the multi-device setting ASAP.