7 ms·

They intentionally make it really hard to migrate your data off their app under the premise of "security". Now, they are EOL'ing desktop apps, which are extreme

They intentionally make it really hard to migrate your data off their app under the premise of "security". Now, they are EOL'ing desktop apps, which are extremely convenient to use, despite the terrible UX. https://support.authy.com/hc/en-us/articles/1260805179070-Export-or-Import-Tokens-in-the-Authy-app https://support.authy.com/hc/en-us/articles/1260805179070-Ex... The process for exporting is doable, but requires fairly deep technical knowledge and it isn't 100% clean. In order to do so, you need that desktop app and a specific version at that. https://www.reddit.com/r/Bitwarden/comments/116kpvf/export_authy_totp_to_enter_in_another_app/ https://www.reddit.com/r/Bitwarden/comments/116kpvf/export_a... I stopped using it ages ago because of these reasons, this should be your heads up to do the same.

polyvisual 3y ago
I use Authy. I've read a few comments about how migrating away is difficult. What do you use instead? I also use bitwarden, but not sure how I feel about passwords and totp being in the same app.
- thesuitonym 3y ago
  It does feel bad, but your password manager is already protected by MFA, right? It does mean you're putting a lot of trust in your password manager, but on the other had, you already kind of were, weren't you?
- mksybr 3y ago
  Aegis & KeepassXC. KeepassXC could do it all alone and seperate TOTPs under a seperate database secured to a different password if you please.
- drpossum 3y ago
  I've moved over to Proton Pass (you can do TOTP on the desktop through a browser, I figured if I'm authenticating into a site I must have internet) but KeepassXC was a strong contender. Both have excellent mobile support and Keepass has native desktop clients. Proton Pass isn't free, though, but I already had their services.
  - protonmail 3y ago
    Happy to hear you've switched to our password manager! Just to clarify, you can use Proton Pass for free too: https://proton.me/pass/free https://proton.me/pass/free.
- latchkey 3y ago
  > not sure how I feel about passwords and totp being in the same app I felt the same way and I've come to realize that it is not a big deal. One advantage is that with a shared password manager account, you can also share the TOTP along with it. Very convenient for a bunch of usecases.
  - gukov 3y ago
    Is it really multifactor then, with everything in Bitwarden?
    - latchkey 3y ago
      The way I see it, your password manager becomes the central point of failure. Therefore, secure your password manager with a hardware security key (yubi). Not all accounts stored in a password manager are created equal... some need more security than others. If there are accounts that you want additional 2FA security on, just use a separate TOTP app. It doesn't have to be an all or none option.
      - deleted 3y ago
        [deleted]
    - therealmarv 3y ago
      The second factor is not meant or designed to safe you against a compromised PC or phone (your session or cookies could be probably more easily stolen even when second factor on another device). Many people have passwords and totp on the same phone too. The second factor is more meant to verify that you are really you to a web site and safeguard your account on that web site.
- toomuchtodo 3y ago
  I use Bitwarden, but have moved as many 2FA/MFA accounts to Passkeys as possible to avoid needing MFA.
- gregmac 3y ago
  > I also use bitwarden, but not sure how I feel about passwords and totp being in the same app. I guess this depends on your threat model. In what cases would your password vault be compromised, but your TOTP vault still be secure? If someone gets access to your unlocked PC/phone, don't they then have access to both? Do you store your TOTP vault password in your password vault (obvious)? If someone gets into your password vault, why wouldn't the same mechanism also let them get into your TOTP vault? (This applies whether it's brute force, keylogger, hardware exploit, or $5 wrench.)
  - fauigerzigerk 3y ago
    >In what cases would your password vault be compromised, but your TOTP vault still be secure? If the password vault is on one device and the TOTP app on another then it would be harder for an attacker to get into both. I have the same concerns about passkeys. How is it secure if the only thing an attacker needs is a single method of accessing a single device?
    - lamontcg 3y ago
      Generally the threat model that TOTP protects against is not someone breaking into your device. The threat model that it protects against is someone compromising your other credentials. So, although not recommended, you could post your login credentials on twitter and still nobody would be able to get into your account. An attacker hacking into your laptop/desktop/phone with access to install keyloggers and hijack connections is not really what it protects against.
      - patrakov 3y ago
        In a corporate setup, it also somewhat protects against intentional policy-violating password sharing between employees.
      - fauigerzigerk 3y ago
        >Generally the threat model that TOTP protects against is not someone breaking into your device. And yet, in some realistic scenarios TOTP does protect me against that, if the second factor is on a different device, kind of like a poor man's yubikey.
- ivandenysov 3y ago
  I use Raivo for TOTP on iOS. It is open source and makes it easy to migrate to another app
  - latchkey 3y ago
    I used to use it, but the author refuses to publish a desktop app. I actually was able to install the iOS app on my desktop, but if I ever remove it, it is gone forever because he revoked it from the appstore. He only wants you to use the desktop receiver. It is also buggy af and doesn't sync properly. He's pretty much not doing any more updates of the app either. That experience pushed me off it forever. Edit: The app has been acquired by a third party. I'd move off it. https://www.reddit.com/r/privacy/comments/158ihxd/raivo_authenticator_has_been_acquired_by_mobime/ https://www.reddit.com/r/privacy/comments/158ihxd/raivo_auth...
- kangabru 3y ago
  I had the same problem and didn't want to keep all of my eggs in the same basket, plus I lost faith in these backup apps after Google Auth lost user codes at some point. I decided to create a private backup which I control and so I built a client-side web app that encrypts QR codes (like 2FA codes). It was inspired by a similar CLI based project I saw here on HN. I still use Authy (for now) but now I have encrypted images that I can decrypt and rescan easily. And since they're just images I saved them in various places and even printed out copies should I lose my phone or Authy access. To 'migrate' my codes out of Authy I just went through each site and regenerated the codes (plus encrypted them). It's annoying that they force you to do this but doesn't take too long. I'm still polishing it up but it works well and I would love some feedback if there's anyone who finds it useful - https://encrypt-qr-codes.netlify.app/ https://encrypt-qr-codes.netlify.app/
politelemon 3y ago
And they try to lock you in to their own ecosystem. If you use sendgrid, it requires an authy specific 2fa code that can only be generated in their app.
- ing33k 3y ago
  Yeah. I have always wondered what they gain by doing this.
  - i386 3y ago
    “Security”
  - gunapologist99 3y ago
    Lock-in by forcing you to use another Twilio product.
- aftbit 3y ago
  I installed Authy on a rooted phone just to yoink the SendGrid token out and put it in our usual shared authentication service. Such a pain in the ass. I would highly recommend against SendGrid in basically all circumstances fwiw.
  - nicoburns 3y ago
    > I would highly recommend against SendGrid in basically all circumstances fwiw. To add another reason: their API will return an error if you send it more than one simultaneous request.
- mattferderer 3y ago
  Sendgrid was my go to email provider for clients pre-acquisition. Once they got bought out & forced their poorly implemented 2fa with mobile phone requirements, I had no choice but to find different providers.
  - djbusby 3y ago
drpossum 3y ago
Important point out of that reddit Bitwarden thread: If you migrate to another app and then delete your authy account, you risk having 2FA removed for some integrated accounts if they're set up to directly use the Authy backend. Twitch in some cases was pointed out.
- RockRobotRock 3y ago
  At some point Cloudflare also used their weird OTP variant
- tareqak 3y ago
  Twitch refused to return me access to one of my accounts for this exact reason (the account that had subscriptions on it was returned, the one without was not).
  - hparadiz 3y ago
    I've abandoned a twitch account because of 2FA nonsense. If you set a phone number as your 2FA and then lose access to it you're screwed. They don't care.
metadat 3y ago
What should I replace it with? Any recommendations for a functionally equivalent cross-device 2FA app?
- dstroot 3y ago
  I migrated to 2FAS, which is open source, free and has a nice UI. Used Authy for ages and just switched. Recommended… https://2fas.com/ https://2fas.com/
  - AaronMT 3y ago
    How was the migration?
  - yumraj 3y ago
    But it also only has mobile apps. Authy is only killing the desktop app, not the mobile ones - at least not yet. What does 2FAS give, genuinely curious in case I'm missing something..
    - badpenny 3y ago
      There's a browser extension: https://2fas.com/browser-extension/ https://2fas.com/browser-extension/.
      - James_Kirk 3y ago
        it still requires you to reach your phone
- notpushkin 3y ago
  Password Store works fine for me: https://www.passwordstore.org/ https://www.passwordstore.org/ https://github.com/tadfisher/pass-otp https://github.com/tadfisher/pass-otp Others have also said Bitwarden isn't too bad: https://bitwarden.com/ https://bitwarden.com/
  - 3y ago
egwynn 3y ago
I had some good luck with https://github.com/token2/authy-migration https://github.com/token2/authy-migration
- latchkey 3y ago
  Nice find!
- drhuseynov 3y ago
  In case anyone is looking for a desktop app to replace Authy, the authy-migration tool from token2 supports exporting TOTP seeds in WinAuth compatible format (use .wa.txt for export file name). Then in WinAuth (https://winauth.github.io/winauth/index.html https://winauth.github.io/winauth/index.html) , just import that file.
- therealmarv 3y ago
  I have a rooted Android phone and with a simple su and cp I copied the Authy XML to another folder which you can import into the app Aegis directly (from there you can export further if you don't like Aegis). I'm currently looking at Ente Auth because it's end2end encrypted and also provides a web UI for viewing the codes. Or I use another Keepass file.
- jdeibele 3y ago
  I used this and it worked very well. Not perfectly. Because Authy doesn't have icons for a lot of services, I stored info as twitter:username, google:username, etc. The script dropped about the service name on about 10 of those, just showing the username. I "imported" the list of QR codes into 2FAS by using my iPhone's camera. Where there wasn't a service, it would say "Service 1", "Service 2", etc. I then went back through with 2FAS on one device and Authy on another, matching the "Service 1" to "Bubble", for example, because the TOTP codes were the same. The one service that didn't seem to transfer was Facebook, which I have in Authy but didn't show up in the QR code list. Several codes in Authy were duplicates, meaning that service:username was the same. 2FAS asked if I wanted to overwrite them. #1, I don't think Authy should allow the same string more than once and #2, again, a simple alphabetization would make maintaining and using Authy more agreeable.
deleted 3y ago
[deleted]

polyvisual 3y ago

I use Authy. I've read a few comments about how migrating away is difficult. What do you use instead? I also use bitwarden, but not sure how I feel about passwords and totp being in the same app.

thesuitonym 3y ago
It does feel bad, but your password manager is already protected by MFA, right? It does mean you're putting a lot of trust in your password manager, but on the other had, you already kind of were, weren't you?
mksybr 3y ago
Aegis & KeepassXC. KeepassXC could do it all alone and seperate TOTPs under a seperate database secured to a different password if you please.
drpossum 3y ago
I've moved over to Proton Pass (you can do TOTP on the desktop through a browser, I figured if I'm authenticating into a site I must have internet) but KeepassXC was a strong contender. Both have excellent mobile support and Keepass has native desktop clients. Proton Pass isn't free, though, but I already had their services.
- protonmail 3y ago
  Happy to hear you've switched to our password manager! Just to clarify, you can use Proton Pass for free too: https://proton.me/pass/free https://proton.me/pass/free.
latchkey 3y ago
> not sure how I feel about passwords and totp being in the same app I felt the same way and I've come to realize that it is not a big deal. One advantage is that with a shared password manager account, you can also share the TOTP along with it. Very convenient for a bunch of usecases.
- gukov 3y ago
  Is it really multifactor then, with everything in Bitwarden?
  - latchkey 3y ago
    The way I see it, your password manager becomes the central point of failure. Therefore, secure your password manager with a hardware security key (yubi). Not all accounts stored in a password manager are created equal... some need more security than others. If there are accounts that you want additional 2FA security on, just use a separate TOTP app. It doesn't have to be an all or none option.
    - deleted 3y ago
      [deleted]
  - therealmarv 3y ago
    The second factor is not meant or designed to safe you against a compromised PC or phone (your session or cookies could be probably more easily stolen even when second factor on another device). Many people have passwords and totp on the same phone too. The second factor is more meant to verify that you are really you to a web site and safeguard your account on that web site.
toomuchtodo 3y ago
I use Bitwarden, but have moved as many 2FA/MFA accounts to Passkeys as possible to avoid needing MFA.
gregmac 3y ago
> I also use bitwarden, but not sure how I feel about passwords and totp being in the same app. I guess this depends on your threat model. In what cases would your password vault be compromised, but your TOTP vault still be secure? If someone gets access to your unlocked PC/phone, don't they then have access to both? Do you store your TOTP vault password in your password vault (obvious)? If someone gets into your password vault, why wouldn't the same mechanism also let them get into your TOTP vault? (This applies whether it's brute force, keylogger, hardware exploit, or $5 wrench.)
- fauigerzigerk 3y ago
  >In what cases would your password vault be compromised, but your TOTP vault still be secure? If the password vault is on one device and the TOTP app on another then it would be harder for an attacker to get into both. I have the same concerns about passkeys. How is it secure if the only thing an attacker needs is a single method of accessing a single device?
  - lamontcg 3y ago
    Generally the threat model that TOTP protects against is not someone breaking into your device. The threat model that it protects against is someone compromising your other credentials. So, although not recommended, you could post your login credentials on twitter and still nobody would be able to get into your account. An attacker hacking into your laptop/desktop/phone with access to install keyloggers and hijack connections is not really what it protects against.
    - patrakov 3y ago
      In a corporate setup, it also somewhat protects against intentional policy-violating password sharing between employees.
    - fauigerzigerk 3y ago
      >Generally the threat model that TOTP protects against is not someone breaking into your device. And yet, in some realistic scenarios TOTP does protect me against that, if the second factor is on a different device, kind of like a poor man's yubikey.
ivandenysov 3y ago
I use Raivo for TOTP on iOS. It is open source and makes it easy to migrate to another app
- latchkey 3y ago
  I used to use it, but the author refuses to publish a desktop app. I actually was able to install the iOS app on my desktop, but if I ever remove it, it is gone forever because he revoked it from the appstore. He only wants you to use the desktop receiver. It is also buggy af and doesn't sync properly. He's pretty much not doing any more updates of the app either. That experience pushed me off it forever. Edit: The app has been acquired by a third party. I'd move off it. https://www.reddit.com/r/privacy/comments/158ihxd/raivo_authenticator_has_been_acquired_by_mobime/ https://www.reddit.com/r/privacy/comments/158ihxd/raivo_auth...
kangabru 3y ago
I had the same problem and didn't want to keep all of my eggs in the same basket, plus I lost faith in these backup apps after Google Auth lost user codes at some point. I decided to create a private backup which I control and so I built a client-side web app that encrypts QR codes (like 2FA codes). It was inspired by a similar CLI based project I saw here on HN. I still use Authy (for now) but now I have encrypted images that I can decrypt and rescan easily. And since they're just images I saved them in various places and even printed out copies should I lose my phone or Authy access. To 'migrate' my codes out of Authy I just went through each site and regenerated the codes (plus encrypted them). It's annoying that they force you to do this but doesn't take too long. I'm still polishing it up but it works well and I would love some feedback if there's anyone who finds it useful - https://encrypt-qr-codes.netlify.app/ https://encrypt-qr-codes.netlify.app/

politelemon 3y ago

And they try to lock you in to their own ecosystem. If you use sendgrid, it requires an authy specific 2fa code that can only be generated in their app.

ing33k 3y ago
Yeah. I have always wondered what they gain by doing this.
- i386 3y ago
  “Security”
- gunapologist99 3y ago
  Lock-in by forcing you to use another Twilio product.
aftbit 3y ago
I installed Authy on a rooted phone just to yoink the SendGrid token out and put it in our usual shared authentication service. Such a pain in the ass. I would highly recommend against SendGrid in basically all circumstances fwiw.
- nicoburns 3y ago
  > I would highly recommend against SendGrid in basically all circumstances fwiw. To add another reason: their API will return an error if you send it more than one simultaneous request.
mattferderer 3y ago
Sendgrid was my go to email provider for clients pre-acquisition. Once they got bought out & forced their poorly implemented 2fa with mobile phone requirements, I had no choice but to find different providers.
- djbusby 3y ago

drpossum 3y ago

Important point out of that reddit Bitwarden thread: If you migrate to another app and then delete your authy account, you risk having 2FA removed for some integrated accounts if they're set up to directly use the Authy backend. Twitch in some cases was pointed out.

RockRobotRock 3y ago
At some point Cloudflare also used their weird OTP variant
tareqak 3y ago
Twitch refused to return me access to one of my accounts for this exact reason (the account that had subscriptions on it was returned, the one without was not).
- hparadiz 3y ago
  I've abandoned a twitch account because of 2FA nonsense. If you set a phone number as your 2FA and then lose access to it you're screwed. They don't care.

metadat 3y ago

What should I replace it with? Any recommendations for a functionally equivalent cross-device 2FA app?

dstroot 3y ago
I migrated to 2FAS, which is open source, free and has a nice UI. Used Authy for ages and just switched. Recommended… https://2fas.com/ https://2fas.com/
- AaronMT 3y ago
  How was the migration?
- yumraj 3y ago
  But it also only has mobile apps. Authy is only killing the desktop app, not the mobile ones - at least not yet. What does 2FAS give, genuinely curious in case I'm missing something..
  - badpenny 3y ago
    There's a browser extension: https://2fas.com/browser-extension/ https://2fas.com/browser-extension/.
    - James_Kirk 3y ago
      it still requires you to reach your phone
notpushkin 3y ago
Password Store works fine for me: https://www.passwordstore.org/ https://www.passwordstore.org/ https://github.com/tadfisher/pass-otp https://github.com/tadfisher/pass-otp Others have also said Bitwarden isn't too bad: https://bitwarden.com/ https://bitwarden.com/
- 3y ago

egwynn 3y ago

I had some good luck with https://github.com/token2/authy-migration https://github.com/token2/authy-migration

latchkey 3y ago
Nice find!
drhuseynov 3y ago
In case anyone is looking for a desktop app to replace Authy, the authy-migration tool from token2 supports exporting TOTP seeds in WinAuth compatible format (use .wa.txt for export file name). Then in WinAuth (https://winauth.github.io/winauth/index.html https://winauth.github.io/winauth/index.html) , just import that file.
therealmarv 3y ago
I have a rooted Android phone and with a simple su and cp I copied the Authy XML to another folder which you can import into the app Aegis directly (from there you can export further if you don't like Aegis). I'm currently looking at Ente Auth because it's end2end encrypted and also provides a web UI for viewing the codes. Or I use another Keepass file.
jdeibele 3y ago
I used this and it worked very well. Not perfectly. Because Authy doesn't have icons for a lot of services, I stored info as twitter:username, google:username, etc. The script dropped about the service name on about 10 of those, just showing the username. I "imported" the list of QR codes into 2FAS by using my iPhone's camera. Where there wasn't a service, it would say "Service 1", "Service 2", etc. I then went back through with 2FAS on one device and Authy on another, matching the "Service 1" to "Bubble", for example, because the TOTP codes were the same. The one service that didn't seem to transfer was Facebook, which I have in Authy but didn't show up in the QR code list. Several codes in Authy were duplicates, meaning that service:username was the same. 2FAS asked if I wanted to overwrite them. #1, I don't think Authy should allow the same string more than once and #2, again, a simple alphabetization would make maintaining and using Authy more agreeable.

deleted 3y ago

[deleted]