10 ms·
End of Life for Twilio Authy Desktop App
- 1270018080 3y agoGreat... I don't really want to switch off of authy but I don't have much of a choice now.
- latchkey 3y agoThey intentionally make it really hard to migrate your data off their app under the premise of "security". Now, they are EOL'ing desktop apps, which are extremely convenient to use, despite the terrible UX. https://support.authy.com/hc/en-us/articles/1260805179070-Export-or-Import-Tokens-in-the-Authy-app https://support.authy.com/hc/en-us/articles/1260805179070-Ex... The process for exporting is doable, but requires fairly deep technical knowledge and it isn't 100% clean. In order to do so, you need that desktop app and a specific version at that. https://www.reddit.com/r/Bitwarden/comments/116kpvf/export_authy_totp_to_enter_in_another_app/ https://www.reddit.com/r/Bitwarden/comments/116kpvf/export_a... I stopped using it ages ago because of these reasons, this should be your heads up to do the same.
- polyvisual 3y agoI use Authy. I've read a few comments about how migrating away is difficult. What do you use instead? I also use bitwarden, but not sure how I feel about passwords and totp being in the same app.
- thesuitonym 3y agoIt does feel bad, but your password manager is already protected by MFA, right? It does mean you're putting a lot of trust in your password manager, but on the other had, you already kind of were, weren't you?
- mksybr 3y agoAegis & KeepassXC. KeepassXC could do it all alone and seperate TOTPs under a seperate database secured to a different password if you please.
- drpossum 3y agoI've moved over to Proton Pass (you can do TOTP on the desktop through a browser, I figured if I'm authenticating into a site I must have internet) but KeepassXC was a strong contender. Both have excellent mobile support and Keepass has native desktop clients. Proton Pass isn't free, though, but I already had their services.
- protonmail 3y agoHappy to hear you've switched to our password manager! Just to clarify, you can use Proton Pass for free too: https://proton.me/pass/free https://proton.me/pass/free.
- latchkey 3y ago> not sure how I feel about passwords and totp being in the same app I felt the same way and I've come to realize that it is not a big deal. One advantage is that with a shared password manager account, you can also share the TOTP along with it. Very convenient for a bunch of usecases.
- gukov 3y agoIs it really multifactor then, with everything in Bitwarden?
- latchkey 3y agoThe way I see it, your password manager becomes the central point of failure. Therefore, secure your password manager with a hardware security key (yubi). Not all accounts stored in a password manager are created equal... some need more security than others. If there are accounts that you want additional 2FA security on, just use a separate TOTP app. It doesn't have to be an all or none option.
- deleted 3y ago[deleted]
- therealmarv 3y agoThe second factor is not meant or designed to safe you against a compromised PC or phone (your session or cookies could be probably more easily stolen even when second factor on another device). Many people have passwords and totp on the same phone too. The second factor is more meant to verify that you are really you to a web site and safeguard your account on that web site.
- toomuchtodo 3y agoI use Bitwarden, but have moved as many 2FA/MFA accounts to Passkeys as possible to avoid needing MFA.
- gregmac 3y ago> I also use bitwarden, but not sure how I feel about passwords and totp being in the same app. I guess this depends on your threat model. In what cases would your password vault be compromised, but your TOTP vault still be secure? If someone gets access to your unlocked PC/phone, don't they then have access to both? Do you store your TOTP vault password in your password vault (obvious)? If someone gets into your password vault, why wouldn't the same mechanism also let them get into your TOTP vault? (This applies whether it's brute force, keylogger, hardware exploit, or $5 wrench.)
- fauigerzigerk 3y ago>In what cases would your password vault be compromised, but your TOTP vault still be secure? If the password vault is on one device and the TOTP app on another then it would be harder for an attacker to get into both. I have the same concerns about passkeys. How is it secure if the only thing an attacker needs is a single method of accessing a single device?
- lamontcg 3y agoGenerally the threat model that TOTP protects against is not someone breaking into your device. The threat model that it protects against is someone compromising your other credentials. So, although not recommended, you could post your login credentials on twitter and still nobody would be able to get into your account. An attacker hacking into your laptop/desktop/phone with access to install keyloggers and hijack connections is not really what it protects against.
- patrakov 3y agoIn a corporate setup, it also somewhat protects against intentional policy-violating password sharing between employees.
- fauigerzigerk 3y ago>Generally the threat model that TOTP protects against is not someone breaking into your device. And yet, in some realistic scenarios TOTP does protect me against that, if the second factor is on a different device, kind of like a poor man's yubikey.
- ivandenysov 3y agoI use Raivo for TOTP on iOS. It is open source and makes it easy to migrate to another app
- latchkey 3y agoI used to use it, but the author refuses to publish a desktop app. I actually was able to install the iOS app on my desktop, but if I ever remove it, it is gone forever because he revoked it from the appstore. He only wants you to use the desktop receiver. It is also buggy af and doesn't sync properly. He's pretty much not doing any more updates of the app either. That experience pushed me off it forever. Edit: The app has been acquired by a third party. I'd move off it. https://www.reddit.com/r/privacy/comments/158ihxd/raivo_authenticator_has_been_acquired_by_mobime/ https://www.reddit.com/r/privacy/comments/158ihxd/raivo_auth...
- kangabru 3y agoI had the same problem and didn't want to keep all of my eggs in the same basket, plus I lost faith in these backup apps after Google Auth lost user codes at some point. I decided to create a private backup which I control and so I built a client-side web app that encrypts QR codes (like 2FA codes). It was inspired by a similar CLI based project I saw here on HN. I still use Authy (for now) but now I have encrypted images that I can decrypt and rescan easily. And since they're just images I saved them in various places and even printed out copies should I lose my phone or Authy access. To 'migrate' my codes out of Authy I just went through each site and regenerated the codes (plus encrypted them). It's annoying that they force you to do this but doesn't take too long. I'm still polishing it up but it works well and I would love some feedback if there's anyone who finds it useful - https://encrypt-qr-codes.netlify.app/ https://encrypt-qr-codes.netlify.app/
- politelemon 3y agoAnd they try to lock you in to their own ecosystem. If you use sendgrid, it requires an authy specific 2fa code that can only be generated in their app.
- ing33k 3y agoYeah. I have always wondered what they gain by doing this.
- i386 3y ago“Security”
- gunapologist99 3y agoLock-in by forcing you to use another Twilio product.
- aftbit 3y agoI installed Authy on a rooted phone just to yoink the SendGrid token out and put it in our usual shared authentication service. Such a pain in the ass. I would highly recommend against SendGrid in basically all circumstances fwiw.
- nicoburns 3y ago> I would highly recommend against SendGrid in basically all circumstances fwiw. To add another reason: their API will return an error if you send it more than one simultaneous request.
- mattferderer 3y agoSendgrid was my go to email provider for clients pre-acquisition. Once they got bought out & forced their poorly implemented 2fa with mobile phone requirements, I had no choice but to find different providers.
- djbusby 3y ago
- drpossum 3y agoImportant point out of that reddit Bitwarden thread: If you migrate to another app and then delete your authy account, you risk having 2FA removed for some integrated accounts if they're set up to directly use the Authy backend. Twitch in some cases was pointed out.
- RockRobotRock 3y agoAt some point Cloudflare also used their weird OTP variant
- tareqak 3y agoTwitch refused to return me access to one of my accounts for this exact reason (the account that had subscriptions on it was returned, the one without was not).
- hparadiz 3y agoI've abandoned a twitch account because of 2FA nonsense. If you set a phone number as your 2FA and then lose access to it you're screwed. They don't care.
- metadat 3y agoWhat should I replace it with? Any recommendations for a functionally equivalent cross-device 2FA app?
- dstroot 3y agoI migrated to 2FAS, which is open source, free and has a nice UI. Used Authy for ages and just switched. Recommended… https://2fas.com/ https://2fas.com/
- AaronMT 3y agoHow was the migration?
- yumraj 3y agoBut it also only has mobile apps. Authy is only killing the desktop app, not the mobile ones - at least not yet. What does 2FAS give, genuinely curious in case I'm missing something..
- badpenny 3y agoThere's a browser extension: https://2fas.com/browser-extension/ https://2fas.com/browser-extension/.
- James_Kirk 3y agoit still requires you to reach your phone
- notpushkin 3y agoPassword Store works fine for me: https://www.passwordstore.org/ https://www.passwordstore.org/ https://github.com/tadfisher/pass-otp https://github.com/tadfisher/pass-otp Others have also said Bitwarden isn't too bad: https://bitwarden.com/ https://bitwarden.com/
- 3y ago
- egwynn 3y agoI had some good luck with https://github.com/token2/authy-migration https://github.com/token2/authy-migration
- latchkey 3y agoNice find!
- drhuseynov 3y agoIn case anyone is looking for a desktop app to replace Authy, the authy-migration tool from token2 supports exporting TOTP seeds in WinAuth compatible format (use .wa.txt for export file name). Then in WinAuth (https://winauth.github.io/winauth/index.html https://winauth.github.io/winauth/index.html) , just import that file.
- therealmarv 3y agoI have a rooted Android phone and with a simple su and cp I copied the Authy XML to another folder which you can import into the app Aegis directly (from there you can export further if you don't like Aegis). I'm currently looking at Ente Auth because it's end2end encrypted and also provides a web UI for viewing the codes. Or I use another Keepass file.
- jdeibele 3y agoI used this and it worked very well. Not perfectly. Because Authy doesn't have icons for a lot of services, I stored info as twitter:username, google:username, etc. The script dropped about the service name on about 10 of those, just showing the username. I "imported" the list of QR codes into 2FAS by using my iPhone's camera. Where there wasn't a service, it would say "Service 1", "Service 2", etc. I then went back through with 2FAS on one device and Authy on another, matching the "Service 1" to "Bubble", for example, because the TOTP codes were the same. The one service that didn't seem to transfer was Facebook, which I have in Authy but didn't show up in the QR code list. Several codes in Authy were duplicates, meaning that service:username was the same. 2FAS asked if I wanted to overwrite them. #1, I don't think Authy should allow the same string more than once and #2, again, a simple alphabetization would make maintaining and using Authy more agreeable.
- deleted 3y ago[deleted]
- ChrisArchitect 3y agoMore previous discussion: https://news.ycombinator.com/item?id=38921618 https://news.ycombinator.com/item?id=38921618
- rc_kas 3y agoIs sad because that one got posted too early and probably won't reach the top of the feed and fewer people will see it. .. and mods will probably delete this one.
- ChrisArchitect 3y agoThat one was just another discussion a month ago, might have some extra tips for alternatives etc. This one is fine, official, and was first for today.
- gnabgib 3y agoNaa, the official source was posted 36 days ago: [0], the one you reference was a more popular dupe posted 7 hours later from a lesser source that referenced the original. [0]: https://news.ycombinator.com/item?id=38916798 https://news.ycombinator.com/item?id=38916798
- ChrisArchitect 3y agoGood job. In this case wasn't really looking for the src but rather pointing to the older discussion for ppl looking for next steps/solutions. Wherever the discussion was then.
- drpossum 3y agoInterestingly, due to how Apple has developed its app ecosystem, it looks like you can still have it on a Mac Apple silicon desktop if you install it via the app store. https://support.authy.com/hc/en-us/articles/17592416719003-A https://support.authy.com/hc/en-us/articles/17592416719003-A... > Note: The iOS app will still be available to download on M1/M2 powered Apple Mac devices. It does work, but it's not first class support, though. You have to enable alternative touch settings if you want do the "drag to the left to delete a token"
- mayneack 3y agoHow do folks use two factor auth for 1password logins? It feels wrong to me to use 1password as the second factor for 1password itself. My last remaining authy second factors are for primary email and 1password. All other second factors are in 1password.
- redrove 3y agoI use a YubiKey.
- vanilla_nut 3y agoTwo ways: - a Yubikey - a sparingly used email account with no 2FA, just a very long password 2FA through the sort-of-secret email account lets me get back into Bitwarden (and thus everything else) even if my house burns down and I lose access to all of my yubikeys. And auth on a device that doesn't easily support yubikeys, like older iPhones. 2FA is very useful, but highly overrated. If you have a sufficiently long and complex memorized password (and the email platform actually lets you create one that's properly long, 40+ characters), it's unlikely that you'll have any problems unless you accidentally share the password somewhere. Of course I feel like all my my precautions are moot when my bank and CC company force SMS 2FA. But I haven't found any with superior security schemes anwyway.
- aamir1rasheed 3y agoSmall side tangent - I’m on Mint Mobile and enabled 2FA for my account there, which is required for all customer calls. This would stop SIM swapping attacks which are the main failure point for SMS 2FA, right?
- nu11ptr 3y agoUgh. I used this for redundancy. In case I lost my phone I wasn't locked out of everything.
- genevra 3y agoPlus since everything uses 2factor nowadays, it's really annoying if your phone dies or isn't otherwise right next to you The desktop app solved this problem for me
- Eric_WVGG 3y agoWorth noting that you can install the Authy iPad app on ARM Macs (unsure about Intel, but I'm skeptical) but seriously, what a terrible app, another great reason to get off that platform
- jedberg 3y ago/mindblown Hadn't even thought of this, thank you! (And it works!)
- therealmarv 3y agoThis literally saved me some years ago when my phone gave up and I was travelling.
- deleted 3y ago[deleted]
- kevinsky 3y agoI migrated to 2FS as I wanted to keep my MFA secrets separate from my BitWarden passwords. It does require some technical knowledge but the how to was thorough and is found here https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d958c93 https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d... Best to get it done quickly before they prevent you from downloading the older version that had the debug console
- memset 3y agoThanks for posting this, just followed the steps on mac and everything worked perfectly.
- secabeen 3y agoYeah, super-ugh. Every 2FA vendor wants to lock you in. I was able to export secrets from GAuthenticator on a rooted phone with sqlite, it looks like that is still possible on Authy too. Another vote for rooting your phone.
- graphe 3y agoI wish I knew this. I have a version of gauth that wasn't able to be exported on an old phone. I lost a bunch of crypto because of this.
- jasonjayr 3y agoI REALLY want to like passkeys, and all these other stronger vendor systems, but the lock in is real. Office365 defaults to their special authenticator, and you have to jump through hoops on the admin side to ensure TOTP is an option. It will be a very real improvement to security for non-tech users, but the refusal to let folks be 100% in control of their key material, and the lazy "it will be available in a later version, we're focusing on the most common use cases" just tells me that the implementers really don't want to do it in the first place: they're waiting for lockin with what's available, and then they'll just say "Well people adopted it w/o this feature, they must not really want it" There 100% has to be a way for the user to own + backup their own private key material, or these are all just paths for stronger lockin. Personally, I have a TOTP App (andOTP) with QRCodes on paper in cold storage, keepass-based tools for passwords across platforms, and Syncthing for syncing across these systems.
- lxgr 3y agoUnfortunately there is no key exchange format specified in either FIDO or WebAuthN, which I view as a major downside as well. The closest you can currently get is an open-source authenticator implementation that lets you export its credentials, like e.g. Bitwarden does (it supposedly lets you export WebAuthN credentials via JSON, but I haven't tried it myself). I get that any UI way to let users export credentials is a potential phishing/social engineering avenue, but the lock-in danger is real, and I'm holding back on WebAuthN as my primary authentication method for now.
- 3y ago
- lxgr 3y agoThis is a great example for why it's a bad idea to tie authentication to a proprietary third-party service. Thank you for promoting open standards, Twilio!
- donkulous 3y agoThis was literally the only reason to use Authy.
- BHSPitMonkey 3y agoI've only ever used it on mobile, so no. For me the reason was sharing TOTP between phones in case my primary gets lost or damaged.
- donkulous 3y agoThat's fair. I should say, it was my main reason for using Authy as there wasn't anything else out there that could do synced mobile and desktop easily for free.
- amanzi 3y agoMaybe not the only reason, but this was definitely one of the main reasons I used Authy. Over time, the product has been getting progressively worse... When I first started using it there was a Chrome App you could install which was great because it could work on "corporate" machines where I wasn't able to install the desktop app. That went away a long time ago, but at least we had the desktop app on Windows, Mac, Linux. Although, at some point Authy was only available on Linux if using Snap, which ruled it out for me (although there is an unofficial Flatpak now). So now they are getting rid of all desktop apps which will be the end of my Authy journey and this will also be the last Twilio product I use, since I've had recent bad experiences with some of their other products.
- redeux 3y agoI feel stupid because I’ve been recommending people use Authy for the past year “because it has a desktop and mobile app.”
- burnJS 3y agoYeah its super convenient. I do keep an old backup phone around just in case and occasionally turn it on to sync, but also have the desktop app.
- truckerbill 3y agoPSA: Keepass (XC?) and the iOS cousins work as a 2FA app and you can freely migrate your data from it.
- mr_sturd 3y agoKeePassDX works with 2FA on Android, but I've had trouble with tokens synced to XC on desktop.
- therealmarv 3y agoWhat is so hard to maintain an already finished Electron app?
- corytheboyd 3y agoI can imagine a scenario where it needs dependency updates, engineers bring this up, bean counters say “well this doesn’t make us money, spend time on things that make us money instead” until eventually the bean counters say “okay we are no longer doing this, shut it down”
- willcipriano 3y agoMore likely they want to get mobile data from desktop users. Probably with a plan to monetize it somehow later.
- corytheboyd 3y agoThat’s even more Occam’s, let’s go with that.
- peblos 3y ago“Focus”. Looks like paring back of everything that doesn’t generate profit https://www.cxtoday.com/data-analytics/the-purge-continues-twilio-to-shutter-authys-desktop-app/ https://www.cxtoday.com/data-analytics/the-purge-continues-t...
- Dalewyn 3y agoAs someone who just uses good old passwords managed with TXT files and sticky notes: Security engineers (marketers?) never seem to understand most people by far value convenience over security.
- nusl 3y agoYou're gonna get pwned, and you're gonna get pwned hard. Brace for it because it's coming sooner or later. It's convenient until you lose all of your passwords.
- nottorp 3y ago> Brace for it because it's coming sooner or later. I wonder if it will be his passwords, or one of the providers of those impenetrable password replacement keys will be breached first, in a way that leaks everything.
- nusl 3y agoUnsure though the OP’s laptop being stolen or a rogue program stealing their passwords.txt is a lot more likely. The providers being attacked will still require the keys themselves to be attacked since they hold the secrets.
- trey-jones 3y agoThe point still needs to be made. I always present security as a sliding scale with secure on one side and convenient on the other. Similar to low-cost and convenient streaming services reducing piracy, and then seeing the return of piracy as they become higher cost and less-convenient, any application needs to consider not only how to protect its users and their data, but also how to not drive away users with security measures that encroach into that inconvenient zone. 2FA can definitely approach that zone in a few different ways eg. having to reauthenticate too often, or especially for technical users in situations where account sharing is a reality that isn't going away anytime soon: by not making your secret tokens readily available. It has been evident for years that Twilio was just trying to force vendor lock-in and I've always hated Authy. The desktop app at least gave you some agency (secrets on a device that you own and fully control), but I guess that was too much too ask in the long term. Aside: there are measures that increase security without affecting convenience (much). Take those first. Additional Aside to the text file password cowboy: since moving into password managers (first lastpass, now bitwarden) I've found it to be more convenient (usually) and I have a lot more peace of mind about it. Maybe try it?
- eviks 3y agoIs there an alternative where you can sync tokens between your phone and your desktop computer? (which was Authy's main useful feature making the Electron bloat acceptable)
- wrs 3y agoPSA: If you’re in the Apple ecosystem, you can copy and paste between devices. https://support.apple.com/en-us/102430 https://support.apple.com/en-us/102430
- kube-system 3y agoAlso: > Note: The iOS app will also be available to download on M1/M2 powered Apple Mac devices.
- jedberg 3y agoThis was mentioned below (HT to Eric_WVGG for pointing it out [0]) but I think it warrants a top level comment: If you have an ARM Mac you can install the Authy iPad app and use it just like the Desktop app. If you want to have a desktop backup but aren't ready to migrate yet, this is a fantastic stop-gap solution. [0] https://news.ycombinator.com/item?id=39360950 https://news.ycombinator.com/item?id=39360950
- jmbwell 3y agoOf course, if you have an Apple product, you can also use the TOTP function built-in to Keychain. iPhone doc here: https://support.apple.com/guide/iphone/automatically-fill-in-verification-codes-ipha6173c19f/ios https://support.apple.com/guide/iphone/automatically-fill-in...
- donkulous 3y agoThe downside to this, is that you're tied into Apple's ecosystem. The nice thing about Authy was that I had the same access on Android, iOS, Windows, Mac, and Linux.
- rgovostes 3y agoApple makes an app for accessing passwords on Windows, but I would not put a lot of faith in them supporting it forever, as Twilio has reminded us. https://support.apple.com/guide/icloud-windows/set-up-icloud-passwords-icw2babf5e03/icloud https://support.apple.com/guide/icloud-windows/set-up-icloud...
- Terretta 3y agoConsider 1Password, with the added bonus of the `op` CLI tool and a variety of other dev conveniences. CLI: https://developer.1password.com/docs/cli/get-started/ https://developer.1password.com/docs/cli/get-started/ Shell plugins: https://developer.1password.com/docs/cli/shell-plugins https://developer.1password.com/docs/cli/shell-plugins Secrets automation: https://developer.1password.com/docs/secrets-automation https://developer.1password.com/docs/secrets-automation
- adamors 3y agoDupe of https://news.ycombinator.com/item?id=39354045 https://news.ycombinator.com/item?id=39354045
- antisthenes 3y agoI really really hate the trend of making desktop users into 2nd rate citizens. From endless scrolling to hamburger menus, to straight up giving a big middle finger to having a desktop app.
- donkulous 3y agoRIP scroll bars.
- uses 3y agoGetting a user to install software on a desktop is probably one of the hardest things for a company to ask for in 2024. It's wild that you would have built up a userbase of ... tens of thousands? ... of technically knowledgeable people who want your product, get them to install and rely on your product on their actual 2024 desktop computer where they do actual work, then have some decision makers determine "ok time to pull the plug" and you actually follow through with that. It's just incomprehensible.
- ejb999 3y agoI agree, seems short-sighted - they could have even just started charging a bit for it to keep it alive if necessary. No surprise though, after a fantastic start, twilio has turned into a sh*t company, unfortunately - I was a very early adaptor of many of their tools and services, and 1 by 1, they have all gone downhill. They should have sold the company while it still had a decent reputation, at this rate there will be nothing of worth left.
- deletaylor 3y agoI would have been happy to pay something to have Authy on desktop and mobile. I switched to them after my phone died and I saw how hard accessing my accounts was without a backup OTP device.
- burnJS 3y agoThe solution is to have a cheap phone that you sync with your authy. I had the trifecta with my desktop, now I just have one backup device because of this change.
- noman-land 3y agoTwilio has taken a nosedive recently. Do you have any suggested alternatives for programmatic voice and text?
- hax0r1 3y ago
- deleted 3y ago[deleted]
- httpz 3y agoI assume many companies are using Twilio for their SMS OTP auth. Does that mean Twilio has a financial interest in steering users away from using Authy?
- nusl 3y agoI'm fairly sure they're going to kill the mobile applications too. Migrating is a pain though.
- justinzollars 3y agoThis sucks. Just creates work for me.
- ijustlovemath 3y agoCan anyone recommend an alternative with similar ux? I use it almost every day, it's very convenient for me! I don't always have my phone around, and also have used it more than once to prevent being locked out of a service
- patrakov 3y agoI use a browser extension from https://authenticator.cc/ https://authenticator.cc/ While I do not know whether its UX is similar, it does have a sync feature (but not cross-browser), an export feature, can backup its data to Google Drive, can store everything encrypted (but not by default), is recommended by at least one government website (SSS Employer Portal in the Philippines), and is there for a long time. Oh, and it also remembers which site each secret comes from, and hides others. The downside is no automatic synchronization with the mobile phone.
- pseufaux 3y agoI've been happy with Ente Auth https://github.com/ente-io/auth https://github.com/ente-io/auth
- rainbowzootsuit 3y agoThis is why I have a hard copy printed folder of all my TOTP seeds.
- tiffanyh 3y agoQuickest way to scare someone into not using MFA/2FA are stories like this.
- jjice 3y agoFor me, the desktop app always sucked (but it was still more convenient that going to my phone). The TOTP would often get completely out of sync unless I backed out of an app's section and went back in, and then waiting for the TOTP to flip.
- burnJS 3y agoYeah its not sexy, but it does work and on Linux too!
- nikolay 3y agoIt's time to leave and entirely switch to 1Password and Microsoft Authenticator (for 1Password's 2FA).
- captn3m0 3y agoIf anyone has ideas on how to write the proper PURLs for this, I am gonna try to get this added to endoflife.date - will appreciate advice for PURLs/CPEs that apply.
- systems 3y agodid anyone try to install the android app on waydroid/linux does it work, is it safe?
- cwbriscoe 3y agoI just got done moving all of my accounts over to Aegis. At the same time, I put the new TOTP key into Proton Pass. Aegis makes it easy to backup your keys and use more than one 2fa app for redundancy.
- EasyMark 3y agoThis is probably my next step as well. It was nice while authy worked though, never had a single issue with it, almost 0 maintenance.
- noman-land 3y ago+1 for Aegis.
- EasyMark 3y agoAny word on how long before they will EOL the phone apps?
- anbotero 3y agoI’m not sure why people who mainly used TOTP and mobile are saying they are going to migrate to something else. I also used the Desktop application, but I could have used my phone in those cases 99% of the time, and if you’re using the Backup feature, you should still be able to recover your account in case you lose your phone, no? Or am I missing something? I migrated from Google Authenticator before it offered backups too precisely for the backups/restoration.
- MrStonedOne 3y agoI do not like being dependent on having a working phone to log in to my digital life. Any break in my phone will take weeks for me to be able to afford to replace, meanwhile what? Im locked out of everything? Why would I risk that? Phone battery is dead so I got to wait 5 minutes to log into my forums while it charges enough to allow me to boot it and then boots? Might as well move purely to yubikey in that case. The whole point of using authy was the reliability of cloneable auth tokens between my desktop, laptop (desktop os) and phone. 3 piece holy trinity. and what? you want to move that down to one? Even if its backed up, what do I do while it is stolen or off for repairs? The ENTIRE point of using authy over any other solution was that its wide app base made it more reliable. They adversely selected for the userbase that would get mad over this
- MrDresden 3y agoAs has been mentioned, not all of us want to have our whole infrastructure relying on a single device (mobile). The desktop app was both convenient but also a backup plan for me. The seemingly unnecessary depreciation of a tool we all use gives of dangerous vibes for the future. It is not that I think that the Authy mobile app is going away, but rather that the design and features of it will slowly become worse over time. History backs me up on this. And honestly, for something as fundamental as 2FA we should be using self hosted and open source tools without any corporate ties anyways. This was just the push I needed to make that happen (Aegis).
- burnJS 3y agoI sent them a support request venting. Will this work? Unlikely, but it takes less than a minute once you move through their automated help flow clicking "no not helpful" https://support.authy.com/hc/en-us https://support.authy.com/hc/en-us
- gorkish 3y agoI regret immensely that I ever endorsed or recommended Authy. My experience witnessing the regression and functional decline of this app over the years has utterly wrecked my opinion of Twilio. Although I still have a couple of operational Twilio integrations, I no longer have any desire to use any of their products or services ever again.
- Delogrand 3y ago2FAS Auth is fully exportable and you can even modify any of your token settings natively in the app.
- 1270018080 3y agoThey don't have a desktop app.
- genevra 3y agoI'm unsure what to switch to as another easy to use desktop cloud based 2factor app that's encrypted I liked the peace of mind of having it in the cloud so I don't randomly lose all of my accounts if I decide to replace my phone This is extremely disappointing, I don't trust many other companies and this is a baffling decisio
- EVa5I7bHFq9mnYK 3y agoGood, because it encouraged bad security practice - running both parts of 2fa on the same device.
- hnbear 3y agoHandily on macos the iOS version runs and is still supported. I ran both side by side to log into the iOS version after downloading it on my MacBook. Login was easy and everything came over. Just had to turn on multi-device, log in on the new app, then turn it off again. Most of my TOTP is in 1Password, but for apps the require Authy integration the iOS version seems fine.
- JSR_FDED 3y agoEven though I only use their iOS version I'm not taking any chances with something as important as this, so decided to ditch Authy on the phone. I looked at a few alternatives, and was pleasantly surprised at the built-in option on iOS and MacOS (and they automatically stay synced between phone and Mac if you're on iCloud). Instead of trying to extract the settings out of Authy, I simply visited each of the sites for which I have 2FA turned on, logged in with the Authy code (for the last time), went to the account config/profile section of the web page and chose "Setup new authenticator" (or similar). Then it shows you a new QR code. At this moment on your iPhone you switch to the Passwords app which is under Settings->Passwords and search for the website or enter a new record. Then click on "Set Up Verification Code", and choose the option to scan the QR code. That's all there's to it. From then on you can log in either from your iPhone or Mac, and doing the fingerprint/FaceId will enter the TOTP code. Tip: After making the change on each website, open an incognito/private browsing window and log in again. That way old cookies can't mess things up. I found one site where the re-doing of the 2FA hadn't worked properly this way.
- drcongo 3y agoI wish they'd kill Authy altogether. It's a terrible app and one particular service I use will only allow Authy for 2FA.
- jrochkind1 3y agoNobody seems to have commented that they just bumped the EOL for Authy Desktop from August to March. With only weeks before the new EOL?