4 ms·

Authy Desktop EOL moved from August 2024 to March 19 2024

28 points by jrochkind1 3y ago

jrochkind1 3y ago
I am not sure when this change was made. Bumping the EOL up 5 months with less than a month of notice before EOL seems like a very unprofessional move. I wonder why they announced the far-off EOL in the first place, and why they had to bump it.
- toomuchtodo 3y ago
  Between layoffs and unprofitably, they’re likely trying to roll off any non revenue producing work or costs as fast as possible. Passkeys are also seeing fairly rapid uptake, negating the need for TOTP (and eventually SMS OTP). Also doesn’t bode well for their revenue depending on how much of Twilio volume are these messages (although I'd expect marketing and political SMS to be more material).
- kingnothing 3y ago
  Maybe there's a critical flaw in it that's being actively exploited
aftbit 3y ago
I wonder if there was some kind of security issue, and they decided to move EoL up to beat a disclosure deadline.
- k8svet 3y ago
  It feels conspiratorial but I'm having a hard time coming up with virtually any other reason that makes any sense whatsoever.
georgel 3y ago
The iOS version running on Apple Silicon is faster than the "desktop" app either way.
- coolsunglasses 3y ago
  iOS version refuses to run on my Apple Silicon Mac because I have the security thingy disabled for debugging :\
- jasongill 3y ago
  agreed, the "desktop" version has always sucked, but if you install the iPad version on macOS it works pretty well. Still buggy, but not nearly as bad as the regular app
- Amorymeltzer 3y ago
  The native feature built into "passwords" (still annoyingly in settings) is where I moved 'em all, works like a charm.
  - pram 3y ago
    Agreed, I moved all my passwords and 2fa to Keychain after the LastPass hack and I couldn’t be happier. The integration with Safari is slick.
    - cchance 3y ago
      Sadly using ARC or chromium in any way means no keychain :( but just swapped to 2fas which uses icloud for backup and sync so ... still really clean and dont have to deal with authy fiasco anymore
hipadev23 3y ago
Spent the past week slowly moving my TOTP from Authy to 1Pass, since the desktop/browser plugin continues to work.
Guillaume86 3y ago
Since the announcement I migrated to 2FAS and it's OK (I don't quite like the mobile UI as much but whatever). The only thing I miss is cloud storage in a dedicated service, aka not Google Drive or any of the services I already use TOTP for, because otherwise I have a circular dependency issue, connecting to Google requires 2FAS, restoring 2FAS requires connecting to Google. Is there any alternative that provide a more "Authy like" experience?
- underyx 3y ago
  How did you migrate? I didn’t see an automated way :(
  - angryasian 3y ago
    Authy doesn't give you a way to export. You have to use this: https://github.com/token2/authy-migration https://github.com/token2/authy-migration Then add each one to whatever service you're migrating to
    - Guillaume86 3y ago
      Yes I used this one
    - cchance 3y ago
      Wow thanks just dropped authy and swapped to 2fas in like 5 minutes lol Now to get a few legacy ones out of microsoft authenticator somehow lol
- discardedrefuse 3y ago
  I didn't find any. and after some thought, I decided I didn't want to be reliant on a 3rd party server again. For me, Google is an important enough account that I have multiple MFA methods like a TOPT, YubiKey, and my Android phone (not SMS).
  - Guillaume86 3y ago
xd1936 3y ago
Bizarre to me that there is no way to export your existing account information. For anyone else looking to export TOTP tokens from Authy... since it is an Electron app, this user created a nice script: https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d958c93 https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d... I successfully used it to get them moved over to Bitwarden.
- Guillaume86 3y ago
  There's also https://github.com/token2/authy-migration https://github.com/token2/authy-migration which worked fine for me.
syntaxing 3y ago
Bitwarden has TOTP support if you pay for premium ($10 a year). Been rock solid and worth the money.
madamelic 3y ago
Am I just weird that I don't trust their "recovery process"? My own process has always included having it installed on all my computers in case one of my devices goes missing or is destroyed. Getting rid of Desktop seems like it's going to increase the amount of recovery processes because of phones getting lost, destroyed, stolen, etc for no real gain beyond not having to support it anymore. Or am I just expected to have a spare phone that I install Authy on and leave in a drawer? My accounts are too valuable and critical to be locked out of them for 48+ hours or forever. I have security keys on everything that supports them but seems very short-sighted to leave this big of a gap in their ecosystem with no planned replacement.
- devrand 3y ago
  Yeah, that was basically my only reason for having it on the desktop. Thankfully I can just install the ipad app on my macbook as a workaround. More than likely though I'll just move all my TOTPs to 1password.
- jrochkind1 3y ago
  Yes, this is precisely why I use Authy -- for multi-device support with Just Works sync. I've got it on cellphone, work laptop, personal laptop. So even if two of these devices get lost or damaged, I still have the one. I don't believe myself capable of keeping all these "recovery codes" for every service. I don't believe most people are. A 2FA ecology that depends on everyone having their "recovery codes" to avoid a situation where a lost/bricked/stolen device means they are locked out of like ALL their services... is an ecology where most people are at some point going to be locked out of all their services. It's pretty incomprehensible to me that this is the ecology that's been built? I don't know of any other thing with multi-device support -- that includes laptops not just phones, I only have one phone! -- that's as seamless a UX for non-techies as Authy. there are some non-free ones, that still aren't really as good usability wise. DIY setup on your own cloud storage does not even come close.
deleted 3y ago
[deleted]
ChrisArchitect 3y ago
[dupe] More discussion over here two weeks ago: https://news.ycombinator.com/item?id=39360439 https://news.ycombinator.com/item?id=39360439
- deleted 3y ago
  [deleted]

28 points by jrochkind1 3y ago

I am not sure when this change was made. Bumping the EOL up 5 months with less than a month of notice before EOL seems like a very unprofessional move. I wonder why they announced the far-off EOL in the first place, and why they had to bump it.

toomuchtodo 3y ago
Between layoffs and unprofitably, they’re likely trying to roll off any non revenue producing work or costs as fast as possible. Passkeys are also seeing fairly rapid uptake, negating the need for TOTP (and eventually SMS OTP). Also doesn’t bode well for their revenue depending on how much of Twilio volume are these messages (although I'd expect marketing and political SMS to be more material).
kingnothing 3y ago
Maybe there's a critical flaw in it that's being actively exploited

aftbit 3y ago

I wonder if there was some kind of security issue, and they decided to move EoL up to beat a disclosure deadline.

k8svet 3y ago
It feels conspiratorial but I'm having a hard time coming up with virtually any other reason that makes any sense whatsoever.

georgel 3y ago

The iOS version running on Apple Silicon is faster than the "desktop" app either way.

coolsunglasses 3y ago
iOS version refuses to run on my Apple Silicon Mac because I have the security thingy disabled for debugging :\
jasongill 3y ago
agreed, the "desktop" version has always sucked, but if you install the iPad version on macOS it works pretty well. Still buggy, but not nearly as bad as the regular app
Amorymeltzer 3y ago
The native feature built into "passwords" (still annoyingly in settings) is where I moved 'em all, works like a charm.
- pram 3y ago
  Agreed, I moved all my passwords and 2fa to Keychain after the LastPass hack and I couldn’t be happier. The integration with Safari is slick.
  - cchance 3y ago
    Sadly using ARC or chromium in any way means no keychain :( but just swapped to 2fas which uses icloud for backup and sync so ... still really clean and dont have to deal with authy fiasco anymore

hipadev23 3y ago

Spent the past week slowly moving my TOTP from Authy to 1Pass, since the desktop/browser plugin continues to work.

Guillaume86 3y ago

Since the announcement I migrated to 2FAS and it's OK (I don't quite like the mobile UI as much but whatever). The only thing I miss is cloud storage in a dedicated service, aka not Google Drive or any of the services I already use TOTP for, because otherwise I have a circular dependency issue, connecting to Google requires 2FAS, restoring 2FAS requires connecting to Google. Is there any alternative that provide a more "Authy like" experience?

underyx 3y ago
How did you migrate? I didn’t see an automated way :(
- angryasian 3y ago
  Authy doesn't give you a way to export. You have to use this: https://github.com/token2/authy-migration https://github.com/token2/authy-migration Then add each one to whatever service you're migrating to
  - Guillaume86 3y ago
    Yes I used this one
  - cchance 3y ago
    Wow thanks just dropped authy and swapped to 2fas in like 5 minutes lol Now to get a few legacy ones out of microsoft authenticator somehow lol
discardedrefuse 3y ago
I didn't find any. and after some thought, I decided I didn't want to be reliant on a 3rd party server again. For me, Google is an important enough account that I have multiple MFA methods like a TOPT, YubiKey, and my Android phone (not SMS).
- Guillaume86 3y ago

xd1936 3y ago

Bizarre to me that there is no way to export your existing account information. For anyone else looking to export TOTP tokens from Authy... since it is an Electron app, this user created a nice script: https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d958c93 https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d... I successfully used it to get them moved over to Bitwarden.

Guillaume86 3y ago
There's also https://github.com/token2/authy-migration https://github.com/token2/authy-migration which worked fine for me.

syntaxing 3y ago

Bitwarden has TOTP support if you pay for premium ($10 a year). Been rock solid and worth the money.

madamelic 3y ago

Am I just weird that I don't trust their "recovery process"? My own process has always included having it installed on all my computers in case one of my devices goes missing or is destroyed. Getting rid of Desktop seems like it's going to increase the amount of recovery processes because of phones getting lost, destroyed, stolen, etc for no real gain beyond not having to support it anymore. Or am I just expected to have a spare phone that I install Authy on and leave in a drawer? My accounts are too valuable and critical to be locked out of them for 48+ hours or forever. I have security keys on everything that supports them but seems very short-sighted to leave this big of a gap in their ecosystem with no planned replacement.

devrand 3y ago
Yeah, that was basically my only reason for having it on the desktop. Thankfully I can just install the ipad app on my macbook as a workaround. More than likely though I'll just move all my TOTPs to 1password.
jrochkind1 3y ago
Yes, this is precisely why I use Authy -- for multi-device support with Just Works sync. I've got it on cellphone, work laptop, personal laptop. So even if two of these devices get lost or damaged, I still have the one. I don't believe myself capable of keeping all these "recovery codes" for every service. I don't believe most people are. A 2FA ecology that depends on everyone having their "recovery codes" to avoid a situation where a lost/bricked/stolen device means they are locked out of like ALL their services... is an ecology where most people are at some point going to be locked out of all their services. It's pretty incomprehensible to me that this is the ecology that's been built? I don't know of any other thing with multi-device support -- that includes laptops not just phones, I only have one phone! -- that's as seamless a UX for non-techies as Authy. there are some non-free ones, that still aren't really as good usability wise. DIY setup on your own cloud storage does not even come close.

deleted 3y ago

[deleted]

ChrisArchitect 3y ago

[dupe] More discussion over here two weeks ago: https://news.ycombinator.com/item?id=39360439 https://news.ycombinator.com/item?id=39360439

deleted 3y ago
[deleted]