3 ms·

Slightly unrelated: is it relatively safe to root android phones nowadays or should I stick to the unrooted standard android? The reason I'm asking is that I'm

by gorgmah 12d ago

Slightly unrelated: is it relatively safe to root android phones nowadays or should I stick to the unrooted standard android? The reason I'm asking is that I'm stuck with authy as a MFA code app, and would like to move to something that has both desktop and phone support, and my conclusion is I'd need to root my phone to get access to the actual MFA seeds (they don't allow exports to keep you stuck in their app).

torben-friis 12d ago
The main issue is that many apps will block rooted phones (banks, state apps and the like). Usually more trouble than it's worth.
- KetoManx64 12d ago
  * some apps. Both of my banking apps work fine with a rooted GrapheneOS phone. If you want to have full control over your phone like you would a Linux laptop, to customize it to your own preferences and maximize privacy, there is nothing else gives you the same amount of control over the device that you bought and paid for. The fact that people pay $1000 for a device and then not be able to fully uninstall pre-installed crapware nor fully block it from the internet is depressing.
  - gunapologist99 11d ago
    GOS is not rooted by default - in fact, rooting breaks the GrapheneOS security model and is unsupported.
    - KetoManx64 11d ago
      I don't care. It's my phone and I care more about my privacy and the ability to sandbox apps (useful every day) than I do about a border patrol agents trying to clone my phone. (Will statistically never happen to me)
throwa356262 12d ago
Some apps such as Aegis allow exporting the MFA secrets.
- gorgmah 12d ago
  I think they allow importing from Authy but only on rooted phones. I missed the train to move away from Authy in 2024 and now the only non-root option is to regenerate the seed from every provider one by one. As other commenters said, rooting my main phone would lock me out of banking apps. I suppose I could find an old phone, sync from authy cloud, root it, and then migrate, but then generating new seeds is probably both safer and faster at that point.
  - throwa356262 12d ago
    Importing is usually not an issue, as you can always enter the secret manually. It is the exporting that is the problem. The secret looks something like this: JBSW Y3DPF QQHO .... (usually fairly short unless its google)
  - shocks 12d ago
    You can extract keys out of Authy using mitm-proxy. I have done it and switched to Bitwarden.
    - gorgmah 12d ago
      Good point, sadly ios only, I'm on android: https://ente.com/help/auth/migration/authy/ https://ente.com/help/auth/migration/authy/ Or do you mean it also works on android but not documented?
  - ForHackernews 12d ago
    It's not quick, but you can submit a GDPR/Subject Access Request to Twilio and after a month or two they will send you all your Authy TOTP seeds. Then you can import them into Aegis or some other FLOSS solution: https://github.com/uiltondutra/authy-migrate https://github.com/uiltondutra/authy-migrate
izacus 12d ago
It was never particularly safe to root the phone - both because it drills a hole into the security model and because you don't have any good ways of verifying what apps asking for root actually do. Moreover, most of root tools and ROMs are rather poorly written and glued together with other forum scripts which you have no way of checking if they're not malware. (There are exceptions.) So no, "safe" it's not and never has been. The tradeoff might be worth it for you as a user though. > The reason I'm asking is that I'm stuck with authy as a MFA code app, and would like to move to something that has both desktop and phone support, and my conclusion is I'd need to root my phone to get access to the actual MFA seeds (they don't allow exports to keep you stuck in their app). The way to do that is to take the hit and recreate your 2FA codes in an opensource app like Aegis or Stratum.
- gorgmah 12d ago
  Thanks for the summary. I agree with you about 2FA, but it's still annoying, I was hoping I would find a lazier solution.
- negura 12d ago
  Not sure why this is downvoted. It's accurate. A major problem is that when you root you loose assurance of the integrity of your /system partition. That means malware can now persist undetected.
fc417fc802 12d ago
The answer really depends. Root by what means? And to what end? Permanent or only temporarily? Personally I reject with extreme prejudice the android security model (it's my &#^@ device not the vendor's). But I don't generally want to grant any apps root. Lineage strikes a nice balance by providing root adb.
- KetoManx64 12d ago
  I want the ability to grant specific apps root through Magisk. Tasker for example for tasks that change system level settings and adaway for system level adblocking, material files for accessing to root filesystem for pulling config files from apps, Swift Backups for backing up all my apps and their data.
exdeejay_ 12d ago
AFAIK rooting an Android phone necessitates a factory reset of the phone beforehand, so I don't think you'd be able to dump the MFA seeds before Authy is uninstalled (unless that's a hardware thing)
- probablyStimmed 11d ago
  That was never the case back when I was rooting phones. Sometimes the phone would reboot immediately after getting root so that you could do something useful like installing recovery, but maybe something has changed.

by gorgmah 12d ago

torben-friis 12d ago

The main issue is that many apps will block rooted phones (banks, state apps and the like). Usually more trouble than it's worth.

KetoManx64 12d ago
* some apps. Both of my banking apps work fine with a rooted GrapheneOS phone. If you want to have full control over your phone like you would a Linux laptop, to customize it to your own preferences and maximize privacy, there is nothing else gives you the same amount of control over the device that you bought and paid for. The fact that people pay $1000 for a device and then not be able to fully uninstall pre-installed crapware nor fully block it from the internet is depressing.
- gunapologist99 11d ago
  GOS is not rooted by default - in fact, rooting breaks the GrapheneOS security model and is unsupported.
  - KetoManx64 11d ago
    I don't care. It's my phone and I care more about my privacy and the ability to sandbox apps (useful every day) than I do about a border patrol agents trying to clone my phone. (Will statistically never happen to me)

throwa356262 12d ago

Some apps such as Aegis allow exporting the MFA secrets.

gorgmah 12d ago
I think they allow importing from Authy but only on rooted phones. I missed the train to move away from Authy in 2024 and now the only non-root option is to regenerate the seed from every provider one by one. As other commenters said, rooting my main phone would lock me out of banking apps. I suppose I could find an old phone, sync from authy cloud, root it, and then migrate, but then generating new seeds is probably both safer and faster at that point.
- throwa356262 12d ago
  Importing is usually not an issue, as you can always enter the secret manually. It is the exporting that is the problem. The secret looks something like this: JBSW Y3DPF QQHO .... (usually fairly short unless its google)
- shocks 12d ago
  You can extract keys out of Authy using mitm-proxy. I have done it and switched to Bitwarden.
  - gorgmah 12d ago
    Good point, sadly ios only, I'm on android: https://ente.com/help/auth/migration/authy/ https://ente.com/help/auth/migration/authy/ Or do you mean it also works on android but not documented?
- ForHackernews 12d ago
  It's not quick, but you can submit a GDPR/Subject Access Request to Twilio and after a month or two they will send you all your Authy TOTP seeds. Then you can import them into Aegis or some other FLOSS solution: https://github.com/uiltondutra/authy-migrate https://github.com/uiltondutra/authy-migrate

izacus 12d ago

It was never particularly safe to root the phone - both because it drills a hole into the security model and because you don't have any good ways of verifying what apps asking for root actually do. Moreover, most of root tools and ROMs are rather poorly written and glued together with other forum scripts which you have no way of checking if they're not malware. (There are exceptions.) So no, "safe" it's not and never has been. The tradeoff might be worth it for you as a user though. > The reason I'm asking is that I'm stuck with authy as a MFA code app, and would like to move to something that has both desktop and phone support, and my conclusion is I'd need to root my phone to get access to the actual MFA seeds (they don't allow exports to keep you stuck in their app). The way to do that is to take the hit and recreate your 2FA codes in an opensource app like Aegis or Stratum.

gorgmah 12d ago
Thanks for the summary. I agree with you about 2FA, but it's still annoying, I was hoping I would find a lazier solution.
negura 12d ago
Not sure why this is downvoted. It's accurate. A major problem is that when you root you loose assurance of the integrity of your /system partition. That means malware can now persist undetected.

fc417fc802 12d ago

The answer really depends. Root by what means? And to what end? Permanent or only temporarily? Personally I reject with extreme prejudice the android security model (it's my &#^@ device not the vendor's). But I don't generally want to grant any apps root. Lineage strikes a nice balance by providing root adb.

KetoManx64 12d ago
I want the ability to grant specific apps root through Magisk. Tasker for example for tasks that change system level settings and adaway for system level adblocking, material files for accessing to root filesystem for pulling config files from apps, Swift Backups for backing up all my apps and their data.

exdeejay_ 12d ago

AFAIK rooting an Android phone necessitates a factory reset of the phone beforehand, so I don't think you'd be able to dump the MFA seeds before Authy is uninstalled (unless that's a hardware thing)

probablyStimmed 11d ago
That was never the case back when I was rooting phones. Sometimes the phone would reboot immediately after getting root so that you could do something useful like installing recovery, but maybe something has changed.