9 ms·
Authy is joining Twilio
- feld 12y agoWhat is the reason for all of these 2FA apps? This is completely unnecessary. If you're going to offer 2FA, please offer at least the following: * TOTP * Yubikey * SMS If you want to partner with someone and ram unnecessary apps down our throats, optionally add the following: * Authy * RSA * etc I have places where I want 2FA but I will not install the Authy app, so I go without. Sorry. Let me use TOTP or my Yubikey.
- rtpg 12y agoYou do realise that with authy you're just registering TOTP stuff right? It's not on the same level as what you're mentioning. It's like complaining about having to use Firefox instead of google.com
- feld 12y agoThen why do they need an account or my phone number to do TOTP?
- mmebane 12y agoYes, that's definitely unfortunate. I don't remember it being required with older versions of the Authy app. I really hate forced cloud service integration, especially in applications that deal with sensitive material.
- rtpg 12y agothey don't, but they want to have a way to verify who you are for things like the sync feature. Even if you don't want to use the feature. This is a pretty good example of not doing something because it represents a minority and would make onboarding more difficult for their actual value-add.
- deleted 12y ago[deleted]
- deleted 12y ago[deleted]
- A_COMPUTER 12y agoBecause Cloudflare requires Authy, not TOTP. It's a pain in my ass because Cloudflare doesn't have sub-accounts and I have more than one person managing a Cloudflare account, but Authy is locked to one device. So as a result I can't turn on two-factor on my Cloudflare account.
- eddieroger 12y agoI don't understand this rage. I've used Authy with regular TOTP services, and in some cases where I was explicitly told to use something else like Google Authenticator. Unless this changes, I don't see any reason to stop using Authy.
- akerl_ 12y agoWhat makes Yubikey part of the "default" set but not Authy or RSA? This seems awfully like "If you're going to offer 2FA, at least offer all the tools I like, before you offer any tools that I don't like". It's also worth noting that Authy's app supports TOTP, last I looked.
- feld 12y agoBecause Yubikey is very reasonably priced and they're very open about their design... and don't require you provide any identifying information to own one.
- mynameisvlad 12y agoWell, except, you have to buy one from somewhere, and I believe they are only officially being sold through their own site or Amazon. So you are providing your identifying information to some party before even getting the device.
- fluidcruft 12y agos/Yubikey/U2F/ (But I will use my Yubikey for U2F) I also refuse to install Authy. I really, really do not like their creeping, creepy intrusiveness and the profiling it enables. I get the feeling that people don't actually understand Authy beyond "Hey, it backs up my secrets to the cloud. Cool!" I recently had to renew my Google Authenticator tokens and I was tempted by Authy but the setup/onboarding sent me away screaming. Then I remembered the NEO can handle this (well except for Amazon tokens). Can't wait for U2F NFC to be standardized.
- feld 12y agoThis precisely. I commend Authy for trying to make 2FA for a wide audience, but security is not easy. Training users is the correct approach. Give an option for those who deeply care about their security. If you're going to grab the industry by the balls and capture the attention of major industry players at least stick to your core values and offer an advanced/expert option for those of us who want to stay out of your system but still use 2FA.
- danielpal 12y agoFounder of @Authy here. Happy to answer any questions.
- whyleyc 12y agoWhat was the acquisition price ?
- feld 12y agoWhy does Authy require I provide my cell phone number and email address? Why do I have to have a user account? This is completely ridiculous. I do not need nor want cloud syncing or backup. You are making Authy a potential target for attacks by associating a user to cloud stored 2FA information. This is not in the spirit of 2FA.
- Icyerasor 7y agoAn in my opinion crucial information is missing in the discussion that unfolded here 4 years ago; still this discussions comes up as a top result when searching for "authy telephone number required" and that is why I want to add something for current and future references: The phone number is only needed to recover access to your encrypted data that is stored on authys servers. If you're questioning yourself whether authy is trustworthy because they require you to provide a phone number for a 2FA-TOTP-Method that does technically not require it at all(!) and thus could pose a potential security degredation, check the FAQ about account recovery/passwords here: https://support.authy.com/hc/en-us/articles/115001950787-Backups-password-Master-password-and-PIN-protection-with-Authy https://support.authy.com/hc/en-us/articles/115001950787-Bac... Quote: * The Backups password is never sent nor stored in our servers for your security * Like the Backups password, the App Protection PIN (and optional biometric data) is never stored in our servers * Like the Backups password and App Protection PIN, the Master Password is never stored in our servers the question still is if you trust those promises - but as authy is backed by twilio (thus lots of 2FA-SMS are already processed by them) the chances are good those guys know what they do and do it responsibly
- oms1005 12y agoInteresting acquisition, glad to see authy as a service living in Twilio instead of just using it. Can't wait to see it in the portal. Make sure you read Jeff's post as well.
- reustle 12y agoJeff's Post https://www.twilio.com/blog/2015/02/ahoy-authy-joins-twilio.html https://www.twilio.com/blog/2015/02/ahoy-authy-joins-twilio....
- deleted 12y ago[deleted]
- deleted 12y ago[deleted]
- austinlyons 12y agoCan anyone with experience give an estimate of the acquisition price?
- zacwest 12y ago> "There are few companies who share our dedication to excellence…" Authy is one of the worst-designed iOS applications I have ever used. It has been this way for a very long time. They are actively hostile to people who try to criticize their poor design choices. I would not classify it as "dedicated to excellence." CloudFlare forces me to keep it installed, so I have to interact with it on occasion. If you have more than about 3 services set up, you have to first scroll to expand the scrolling list of icons, then scroll multiple times to find and read the 10pt font name of a service, etc. It's awful. Compare it to Google Authenticator, which has a nice, big scrolling list of numbers and names. The one advantage Authy has is encrypted backup, which I like, and service lock-in, which annoys me. Perhaps there's hope in somebody else taking over. Please, Twilio: prioritize _usability_.
- sjs382 12y agoOn Android, it's attractive, functional, and lets me quickly switch between services. I'm not sure what it could do better. FWIW, I have 4 services set up on it.
- ceejayoz 12y agoIt's great with four services. It's awful with dozens. I, for example, have four client AWS accounts, each with the AWS icon, that are rather difficult to distinguish between. The earlier iOS app (with a left-hand side drawer and larger text) was much better for me.
- faet 12y agoHave you not updated in a while? For me it works fine. I see all the icons for all of my services all the time. Click the one I want and get the number. No Scrolling required. Current screenshot http://i.imgur.com/EzNc2g9.jpg http://i.imgur.com/EzNc2g9.jpg
- deleted 12y ago[deleted]
- bdcravens 12y ago
- philip1209 12y agoWhen I first tried Authy, I was amused by bluetooth sync for OTPs. Then, when I tried hardware TSV like yubikeys, I realized that Authy was only a marginal improvement in technology, while it would take a complete rethinking of the system - e.g. Yubikey - to scale to dozens of accounts, multiple devices, and corporate adoption.
- tomasien 12y agoLots of hostility toward Authy on here, I'm shocked. I'm an Authy user and I've always liked the service in that I've barely noticed it existed. Super glad to use 1 app for most services I have 2FA on.
- madsushi 12y agoYeah, my sentiment on this acquisition is "one company I like/use buying another company I like/use, I hope it goes well". I switched to Authy when Google Auth 'forgot' all my tokens in one of its updates (which ended up being restored later), and Authy has worked flawlessly since then.
- lmg643 12y agoI stopped using Authy a few weeks ago after I upgraded phones and lost access to all the tokens I had on my own phone. Perhaps I should have read the instructions more carefully, perhaps I am an idiot. But I thought the purpose of an app linked to my cell phone number is that these codes would port automatically. As a result, I will never use Authy again. SMS validation seems to work fine, which is good business for Twilio. Not sure I understand the acquisition, unless Authy has some good math in their code generation process.
- tjohns 12y agoIn my experience, Authy does port your OTP tokens between devices. The ones that use their backend infrastructure are tied to your phone number, and are ported automatically. Ones that you import from other TOTP-based systems via a QR code (like Google Authenticator) are private to your device by default. But if you really want, you can turn on the optional "backup" feature in settings, which will upload them to your Authy account and automatically port them between phones. Sure, it requires an extra step... but to be fair, normal behavior for TOTP codes is to keep them 100% local to the device. I'd argue this is a reasonable default, given that security is involved. TOTP services almost always require a backup method (SMS or scratch codes) in case you switch phones, anyway.
- peterkelly 12y agoYou spelt "was acqui-hired by" wrong