End of Life for Twilio Authy Desktop App

https://help.twilio.com/articles/22771146070299-End-user-guide-End-of-Life-EOL-for-Twilio-Authy-Desktop-app

by tempestn • 2 years ago

227 172 2 years ago

help.twilio.com

latchkey5• 2 years ago

They intentionally make it really hard to migrate your data off their app under the premise of "security". Now, they are EOL'ing desktop apps, which are extremely convenient to use, despite the terrible UX.

https://support.authy.com/hc/en-us/articles/1260805179070-Ex...

The process for exporting is doable, but requires fairly deep technical knowledge and it isn't 100% clean. In order to do so, you need that desktop app and a specific version at that.

https://www.reddit.com/r/Bitwarden/comments/116kpvf/export_a...

I stopped using it ages ago because of these reasons, this should be your heads up to do the same.

polyvisual• 2 years ago

I use Authy. I've read a few comments about how migrating away is difficult. What do you use instead?

I also use bitwarden, but not sure how I feel about passwords and totp being in the same app.

drpossum3• 2 years ago

I've moved over to Proton Pass (you can do TOTP on the desktop through a browser, I figured if I'm authenticating into a site I must have internet) but KeepassXC was a strong contender. Both have excellent mobile support and Keepass has native desktop clients.

Proton Pass isn't free, though, but I already had their services.

latchkey5• 2 years ago

not sure how I feel about passwords and totp being in the same app

I felt the same way and I've come to realize that it is not a big deal. One advantage is that with a shared password manager account, you can also share the TOTP along with it. Very convenient for a bunch of usecases.

mksybr• 2 years ago

Aegis & KeepassXC. KeepassXC could do it all alone and seperate TOTPs under a seperate database secured to a different password if you please.

toomuchtodo• 2 years ago

I use Bitwarden, but have moved as many 2FA/MFA accounts to Passkeys as possible to avoid needing MFA.

gregmac• 2 years ago

I also use bitwarden, but not sure how I feel about passwords and totp being in the same app.

I guess this depends on your threat model. In what cases would your password vault be compromised, but your TOTP vault still be secure?

If someone gets access to your unlocked PC/phone, don't they then have access to both? Do you store your TOTP vault password in your password vault (obvious)?

If someone gets into your password vault, why wouldn't the same mechanism also let them get into your TOTP vault? (This applies whether it's brute force, keylogger, hardware exploit, or $5 wrench.)

thesuitonym• 2 years ago

It does feel bad, but your password manager is already protected by MFA, right?

It does mean you're putting a lot of trust in your password manager, but on the other had, you already kind of were, weren't you?

ivandenysov• 2 years ago

I use Raivo for TOTP on iOS. It is open source and makes it easy to migrate to another app

kangabru• 2 years ago

I had the same problem and didn't want to keep all of my eggs in the same basket, plus I lost faith in these backup apps after Google Auth lost user codes at some point.

I decided to create a private backup which I control and so I built a client-side web app that encrypts QR codes (like 2FA codes). It was inspired by a similar CLI based project I saw here on HN. I still use Authy (for now) but now I have encrypted images that I can decrypt and rescan easily. And since they're just images I saved them in various places and even printed out copies should I lose my phone or Authy access.

To 'migrate' my codes out of Authy I just went through each site and regenerated the codes (plus encrypted them). It's annoying that they force you to do this but doesn't take too long.

I'm still polishing it up but it works well and I would love some feedback if there's anyone who finds it useful - https://encrypt-qr-codes.netlify.app/

politelemon• 2 years ago

And they try to lock you in to their own ecosystem. If you use sendgrid, it requires an authy specific 2fa code that can only be generated in their app.

ing33k• 2 years ago

Yeah. I have always wondered what they gain by doing this.

aftbit• 2 years ago

I installed Authy on a rooted phone just to yoink the SendGrid token out and put it in our usual shared authentication service. Such a pain in the ass. I would highly recommend against SendGrid in basically all circumstances fwiw.

mattferderer• 2 years ago

Sendgrid was my go to email provider for clients pre-acquisition.

Once they got bought out & forced their poorly implemented 2fa with mobile phone requirements, I had no choice but to find different providers.

tczMUFlmoNk• 2 years ago

Yes, and, if you create a SendGrid account and therefore an Authy account, this may immediately enroll other accounts of yours on entirely unrelated websites/services/platforms into Authy, presumably by correlating your phone number. (Even if the email address is different!) This includes big sites like Twitch, and also includes sites where you had selected the "only allow 2FA via security keys" option. Of course some of the blame here probably falls on those platforms, but both the fact that this is possible and the fact that Twilio encourages these patterns are reprehensible.

drpossum3• 2 years ago

Important point out of that reddit Bitwarden thread:

If you migrate to another app and then delete your authy account, you risk having 2FA removed for some integrated accounts if they're set up to directly use the Authy backend. Twitch in some cases was pointed out.

RockRobotRock• 2 years ago

At some point Cloudflare also used their weird OTP variant

tareqak• 2 years ago

Twitch refused to return me access to one of my accounts for this exact reason (the account that had subscriptions on it was returned, the one without was not).

metadat• 2 years ago

What should I replace it with? Any recommendations for a functionally equivalent cross-device 2FA app?

dstroot• 2 years ago

I migrated to 2FAS, which is open source, free and has a nice UI. Used Authy for ages and just switched. Recommended…

https://2fas.com/

notpushkin3• 2 years ago

Password Store works fine for me: https://www.passwordstore.org/

https://github.com/tadfisher/pass-otp

Others have also said Bitwarden isn't too bad: https://bitwarden.com/

figassis• 2 years ago

1Password

yumraj2• 2 years ago

I just tried adding to KeePass XC - worked well, generates the same OTPs.

PenguinCoder• 2 years ago

Aegis 2FA

lotsofpulp• 2 years ago

KeePass databases with KeepassXC. I like to use Strongbox on macOS/iOS though (still save to Keepass databases though so I don't have to depend on Strongbox).

rsync• 2 years ago

The easiest thing to do is set up a 2FA mule.

egwynn• 2 years ago

I had some good luck with https://github.com/token2/authy-migration

latchkey5• 2 years ago

Nice find!

drhuseynov• 2 years ago

In case anyone is looking for a desktop app to replace Authy, the authy-migration tool from token2 supports exporting TOTP seeds in WinAuth compatible format (use .wa.txt for export file name). Then in WinAuth (https://winauth.github.io/winauth/index.html) , just import that file.

therealmarv4• 2 years ago

I have a rooted Android phone and with a simple su and cp I copied the Authy XML to another folder which you can import into the app Aegis directly (from there you can export further if you don't like Aegis). I'm currently looking at Ente Auth because it's end2end encrypted and also provides a web UI for viewing the codes. Or I use another Keepass file.

jdeibele3• 2 years ago

I used this and it worked very well. Not perfectly.

Because Authy doesn't have icons for a lot of services, I stored info as twitter:username, google:username, etc. The script dropped about the service name on about 10 of those, just showing the username.

I "imported" the list of QR codes into 2FAS by using my iPhone's camera. Where there wasn't a service, it would say "Service 1", "Service 2", etc.

I then went back through with 2FAS on one device and Authy on another, matching the "Service 1" to "Bubble", for example, because the TOTP codes were the same.

The one service that didn't seem to transfer was Facebook, which I have in Authy but didn't show up in the QR code list.

Several codes in Authy were duplicates, meaning that service:username was the same. 2FAS asked if I wanted to overwrite them. #1, I don't think Authy should allow the same string more than once and #2, again, a simple alphabetization would make maintaining and using Authy more agreeable.

ChrisArchitect3• 2 years ago

More previous discussion: https://news.ycombinator.com/item?id=38921618

rc_kas• 2 years ago

Is sad because that one got posted too early and probably won't reach the top of the feed and fewer people will see it.

.. and mods will probably delete this one.

ChrisArchitect3• 2 years ago

That one was just another discussion a month ago, might have some extra tips for alternatives etc. This one is fine, official, and was first for today.

drpossum3• 2 years ago

Interestingly, due to how Apple has developed its app ecosystem, it looks like you can still have it on a Mac Apple silicon desktop if you install it via the app store.

https://support.authy.com/hc/en-us/articles/17592416719003-A...

Note: The iOS app will still be available to download on M1/M2 powered Apple Mac devices.

It does work, but it's not first class support, though. You have to enable alternative touch settings if you want do the "drag to the left to delete a token"

mayneack• 2 years ago

How do folks use two factor auth for 1password logins? It feels wrong to me to use 1password as the second factor for 1password itself. My last remaining authy second factors are for primary email and 1password. All other second factors are in 1password.

redrove2• 2 years ago

I use a YubiKey.

lxgr4• 2 years ago

Does 1Password allow multiple/backup hardware authenticators?

vanilla_nut2• 2 years ago

Two ways:

- a Yubikey - a sparingly used email account with no 2FA, just a very long password

2FA through the sort-of-secret email account lets me get back into Bitwarden (and thus everything else) even if my house burns down and I lose access to all of my yubikeys. And auth on a device that doesn't easily support yubikeys, like older iPhones.

2FA is very useful, but highly overrated. If you have a sufficiently long and complex memorized password (and the email platform actually lets you create one that's properly long, 40+ characters), it's unlikely that you'll have any problems unless you accidentally share the password somewhere.

Of course I feel like all my my precautions are moot when my bank and CC company force SMS 2FA. But I haven't found any with superior security schemes anwyway.

aamir1rasheed• 2 years ago

Small side tangent - I’m on Mint Mobile and enabled 2FA for my account there, which is required for all customer calls. This would stop SIM swapping attacks which are the main failure point for SMS 2FA, right?

TurningCanadian• 2 years ago

Passwords don't protect against spoofed login pages.

jorvi• 2 years ago

2FA is very useful, but highly overrated.

What a bizarre statement. It protects you from any password leak.

If you have 2FA, even if you get keylogged or phished or breached or shoulder peeked, your intruder still does not gain access.

throwaway918274• 2 years ago

I used to use Authy (lol) as my second factor for 1Password and then 1Password for everything else. After migrating off of 1password, I just use Authy for everything...

jamesponddotco• 2 years ago

For 1Password I use a Yubikey, but for 2FA in general, I have a backup phone running Aegis[1].

[1] https://getaegis.app/

zedpm• 2 years ago

I use Authy on my phone and watch, but not Authy on the desktop for exactly this reason; if my computer is compromised and 1password is accessible, they still don't have access to my TOTP codes. Having it on both my watch and phone means I can break a device and not lose access.

nu11ptr• 2 years ago

Ugh. I used this for redundancy. In case I lost my phone I wasn't locked out of everything.

Eric_WVGG• 2 years ago

Worth noting that you can install the Authy iPad app on ARM Macs (unsure about Intel, but I'm skeptical)

but seriously, what a terrible app, another great reason to get off that platform

jedberg2• 2 years ago

/mindblown

Hadn't even thought of this, thank you!

(And it works!)

therealmarv4• 2 years ago

This literally saved me some years ago when my phone gave up and I was travelling.

genevra2• 2 years ago

Plus since everything uses 2factor nowadays, it's really annoying if your phone dies or isn't otherwise right next to you

The desktop app solved this problem for me

kevinsky• 2 years ago

I migrated to 2FS as I wanted to keep my MFA secrets separate from my BitWarden passwords. It does require some technical knowledge but the how to was thorough and is found here https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d...

Best to get it done quickly before they prevent you from downloading the older version that had the debug console

memset• 2 years ago

Thanks for posting this, just followed the steps on mac and everything worked perfectly.

secabeen• 2 years ago

Yeah, super-ugh. Every 2FA vendor wants to lock you in. I was able to export secrets from GAuthenticator on a rooted phone with sqlite, it looks like that is still possible on Authy too. Another vote for rooting your phone.

graphe• 2 years ago

I wish I knew this. I have a version of gauth that wasn't able to be exported on an old phone. I lost a bunch of crypto because of this.

jasonjayr• 2 years ago

I REALLY want to like passkeys, and all these other stronger vendor systems, but the lock in is real. Office365 defaults to their special authenticator, and you have to jump through hoops on the admin side to ensure TOTP is an option. It will be a very real improvement to security for non-tech users, but the refusal to let folks be 100% in control of their key material, and the lazy "it will be available in a later version, we're focusing on the most common use cases" just tells me that the implementers really don't want to do it in the first place: they're waiting for lockin with what's available, and then they'll just say "Well people adopted it w/o this feature, they must not really want it"

There 100% has to be a way for the user to own + backup their own private key material, or these are all just paths for stronger lockin.

Personally, I have a TOTP App (andOTP) with QRCodes on paper in cold storage, keepass-based tools for passwords across platforms, and Syncthing for syncing across these systems.

lxgr4• 2 years ago

Unfortunately there is no key exchange format specified in either FIDO or WebAuthN, which I view as a major downside as well.

The closest you can currently get is an open-source authenticator implementation that lets you export its credentials, like e.g. Bitwarden does (it supposedly lets you export WebAuthN credentials via JSON, but I haven't tried it myself).

I get that any UI way to let users export credentials is a potential phishing/social engineering avenue, but the lock-in danger is real, and I'm holding back on WebAuthN as my primary authentication method for now.

lxgr4• 2 years ago

The newest version of Google Authenticator just lets you display the setup QR code again, no rooting necessary!

noman-land3• 2 years ago

Aegis is great.

lxgr4• 2 years ago

This is a great example for why it's a bad idea to tie authentication to a proprietary third-party service. Thank you for promoting open standards, Twilio!

donkulous4• 2 years ago

This was literally the only reason to use Authy.

BHSPitMonkey• 2 years ago

I've only ever used it on mobile, so no. For me the reason was sharing TOTP between phones in case my primary gets lost or damaged.

donkulous4• 2 years ago

That's fair. I should say, it was my main reason for using Authy as there wasn't anything else out there that could do synced mobile and desktop easily for free.

amanzi• 2 years ago

Maybe not the only reason, but this was definitely one of the main reasons I used Authy. Over time, the product has been getting progressively worse... When I first started using it there was a Chrome App you could install which was great because it could work on "corporate" machines where I wasn't able to install the desktop app. That went away a long time ago, but at least we had the desktop app on Windows, Mac, Linux. Although, at some point Authy was only available on Linux if using Snap, which ruled it out for me (although there is an unofficial Flatpak now). So now they are getting rid of all desktop apps which will be the end of my Authy journey and this will also be the last Twilio product I use, since I've had recent bad experiences with some of their other products.

redeux• 2 years ago

I feel stupid because I’ve been recommending people use Authy for the past year “because it has a desktop and mobile app.”

burnJS4• 2 years ago

Yeah its super convenient. I do keep an old backup phone around just in case and occasionally turn it on to sync, but also have the desktop app.

truckerbill• 2 years ago

PSA: Keepass (XC?) and the iOS cousins work as a 2FA app and you can freely migrate your data from it.

mr_sturd• 2 years ago

KeePassDX works with 2FA on Android, but I've had trouble with tokens synced to XC on desktop.

therealmarv4• 2 years ago

What is so hard to maintain an already finished Electron app?

corytheboyd2• 2 years ago

I can imagine a scenario where it needs dependency updates, engineers bring this up, bean counters say “well this doesn’t make us money, spend time on things that make us money instead” until eventually the bean counters say “okay we are no longer doing this, shut it down”

willcipriano• 2 years ago

More likely they want to get mobile data from desktop users. Probably with a plan to monetize it somehow later.

peblos• 2 years ago

“Focus”. Looks like paring back of everything that doesn’t generate profit

https://www.cxtoday.com/data-analytics/the-purge-continues-t...

Dalewyn2• 2 years ago

As someone who just uses good old passwords managed with TXT files and sticky notes: Security engineers (marketers?) never seem to understand most people by far value convenience over security.

nusl5• 2 years ago

You're gonna get pwned, and you're gonna get pwned hard. Brace for it because it's coming sooner or later. It's convenient until you lose all of your passwords.

nottorp• 2 years ago

Brace for it because it's coming sooner or later.

I wonder if it will be his passwords, or one of the providers of those impenetrable password replacement keys will be breached first, in a way that leaks everything.

trey-jones• 2 years ago

The point still needs to be made.

I always present security as a sliding scale with secure on one side and convenient on the other. Similar to low-cost and convenient streaming services reducing piracy, and then seeing the return of piracy as they become higher cost and less-convenient, any application needs to consider not only how to protect its users and their data, but also how to not drive away users with security measures that encroach into that inconvenient zone.

2FA can definitely approach that zone in a few different ways eg. having to reauthenticate too often, or especially for technical users in situations where account sharing is a reality that isn't going away anytime soon: by not making your secret tokens readily available. It has been evident for years that Twilio was just trying to force vendor lock-in and I've always hated Authy. The desktop app at least gave you some agency (secrets on a device that you own and fully control), but I guess that was too much too ask in the long term.

Aside: there are measures that increase security without affecting convenience (much). Take those first.

Additional Aside to the text file password cowboy: since moving into password managers (first lastpass, now bitwarden) I've found it to be more convenient (usually) and I have a lot more peace of mind about it. Maybe try it?

Dalewyn2• 2 years ago

I can count the passwords truly critical to my livelihood on one hand (and those are unique). I couldn't care less about everything else (and they all more or less share the same or similar passwords), pwn away.

stephenr• 2 years ago

... I can't comment on the tool in the article because I've never used it, but I'm pretty confident a good password manager is more convenient than text files or sticky notes, while being more secure.

But also I think you're being naïve if you think security(-adjacent) people don't understand that people often prefer convenience.

The entire concept of a password manager is about convenience. Why do you think most mobile devices default to asking for a PIN code rather than a password? Why do you think credit/debit cards use a PIN rather than a complex password?

Convenience. It's literally all to make things more convenient.

eviks• 2 years ago

Is there an alternative where you can sync tokens between your phone and your desktop computer? (which was Authy's main useful feature making the Electron bloat acceptable)

wrs• 2 years ago

PSA: If you’re in the Apple ecosystem, you can copy and paste between devices.

https://support.apple.com/en-us/102430

kube-system• 2 years ago

Also:

Note: The iOS app will also be available to download on M1/M2 powered Apple Mac devices.

jedberg2• 2 years ago

This was mentioned below (HT to Eric_WVGG for pointing it out [0]) but I think it warrants a top level comment:

If you have an ARM Mac you can install the Authy iPad app and use it just like the Desktop app.

If you want to have a desktop backup but aren't ready to migrate yet, this is a fantastic stop-gap solution.

[0] https://news.ycombinator.com/item?id=39360950

jmbwell• 2 years ago

Of course, if you have an Apple product, you can also use the TOTP function built-in to Keychain. iPhone doc here:

https://support.apple.com/guide/iphone/automatically-fill-in...

donkulous4• 2 years ago

The downside to this, is that you're tied into Apple's ecosystem. The nice thing about Authy was that I had the same access on Android, iOS, Windows, Mac, and Linux.

adamors• 2 years ago

Dupe of https://news.ycombinator.com/item?id=39354045

antisthenes• 2 years ago

I really really hate the trend of making desktop users into 2nd rate citizens.

From endless scrolling to hamburger menus, to straight up giving a big middle finger to having a desktop app.

donkulous4• 2 years ago

RIP scroll bars.

uses• 2 years ago

Getting a user to install software on a desktop is probably one of the hardest things for a company to ask for in 2024. It's wild that you would have built up a userbase of ... tens of thousands? ... of technically knowledgeable people who want your product, get them to install and rely on your product on their actual 2024 desktop computer where they do actual work, then have some decision makers determine "ok time to pull the plug" and you actually follow through with that. It's just incomprehensible.

ejb999• 2 years ago

I agree, seems short-sighted - they could have even just started charging a bit for it to keep it alive if necessary.

No surprise though, after a fantastic start, twilio has turned into a sh*t company, unfortunately - I was a very early adaptor of many of their tools and services, and 1 by 1, they have all gone downhill.

They should have sold the company while it still had a decent reputation, at this rate there will be nothing of worth left.

deletaylor• 2 years ago

I would have been happy to pay something to have Authy on desktop and mobile.

I switched to them after my phone died and I saw how hard accessing my accounts was without a backup OTP device.

noman-land3• 2 years ago

Twilio has taken a nosedive recently. Do you have any suggested alternatives for programmatic voice and text?

api• 2 years ago

Getting a user to install software on a desktop is probably one of the hardest things for a company to ask for in 2024.

Really? What do people use desktops for then? Why doesn't everyone just use phones and Chromebooks?

There's no point in buying a desktop if you aren't going to run software on it.

httpz• 2 years ago

I assume many companies are using Twilio for their SMS OTP auth.

Does that mean Twilio has a financial interest in steering users away from using Authy?

yid• 2 years ago

Twilio owns Authy

ncallaway• 2 years ago

Right. Which is why they were noting the implication that if Twilio earns a higher margin from an SMS 2FA vs an Authy 2FA, maybe the owners of Authy would discourage the use of Authy through actions like this.

nusl5• 2 years ago

I'm fairly sure they're going to kill the mobile applications too. Migrating is a pain though.

justinzollars• 2 years ago

This sucks. Just creates work for me.

ijustlovemath• 2 years ago

Can anyone recommend an alternative with similar ux? I use it almost every day, it's very convenient for me! I don't always have my phone around, and also have used it more than once to prevent being locked out of a service

patrakov2• 2 years ago

I use a browser extension from https://authenticator.cc/

While I do not know whether its UX is similar, it does have a sync feature (but not cross-browser), an export feature, can backup its data to Google Drive, can store everything encrypted (but not by default), is recommended by at least one government website (SSS Employer Portal in the Philippines), and is there for a long time. Oh, and it also remembers which site each secret comes from, and hides others.

The downside is no automatic synchronization with the mobile phone.

pseufaux• 2 years ago

I've been happy with Ente Auth

https://github.com/ente-io/auth

rainbowzootsuit• 2 years ago

This is why I have a hard copy printed folder of all my TOTP seeds.

tiffanyh• 2 years ago

Quickest way to scare someone into not using MFA/2FA are stories like this.

jjice• 2 years ago

For me, the desktop app always sucked (but it was still more convenient that going to my phone). The TOTP would often get completely out of sync unless I backed out of an app's section and went back in, and then waiting for the TOTP to flip.

burnJS4• 2 years ago

Yeah its not sexy, but it does work and on Linux too!

nikolay• 2 years ago

It's time to leave and entirely switch to 1Password and Microsoft Authenticator (for 1Password's 2FA).

12700180802• 2 years ago

Great... I don't really want to switch off of authy but I don't have much of a choice now.

systems• 2 years ago

did anyone try to install the android app on waydroid/linux does it work, is it safe?

cwbriscoe2• 2 years ago

I just got done moving all of my accounts over to Aegis. At the same time, I put the new TOTP key into Proton Pass. Aegis makes it easy to backup your keys and use more than one 2fa app for redundancy.

EasyMark3• 2 years ago

This is probably my next step as well. It was nice while authy worked though, never had a single issue with it, almost 0 maintenance.

noman-land3• 2 years ago

+1 for Aegis.

captn3m0• 2 years ago

If anyone has ideas on how to write the proper PURLs for this, I am gonna try to get this added to endoflife.date - will appreciate advice for PURLs/CPEs that apply.

EasyMark3• 2 years ago

Any word on how long before they will EOL the phone apps?

anbotero• 2 years ago

I’m not sure why people who mainly used TOTP and mobile are saying they are going to migrate to something else. I also used the Desktop application, but I could have used my phone in those cases 99% of the time, and if you’re using the Backup feature, you should still be able to recover your account in case you lose your phone, no? Or am I missing something?

I migrated from Google Authenticator before it offered backups too precisely for the backups/restoration.

MrStonedOne• 2 years ago

I do not like being dependent on having a working phone to log in to my digital life.

Any break in my phone will take weeks for me to be able to afford to replace, meanwhile what? Im locked out of everything?

Why would I risk that?

Phone battery is dead so I got to wait 5 minutes to log into my forums while it charges enough to allow me to boot it and then boots?

Might as well move purely to yubikey in that case.

The whole point of using authy was the reliability of cloneable auth tokens between my desktop, laptop (desktop os) and phone.

3 piece holy trinity.

and what? you want to move that down to one?

Even if its backed up, what do I do while it is stolen or off for repairs?

The ENTIRE point of using authy over any other solution was that its wide app base made it more reliable.

They adversely selected for the userbase that would get mad over this

MrDresden• 2 years ago

As has been mentioned, not all of us want to have our whole infrastructure relying on a single device (mobile). The desktop app was both convenient but also a backup plan for me.

The seemingly unnecessary depreciation of a tool we all use gives of dangerous vibes for the future.

It is not that I think that the Authy mobile app is going away, but rather that the design and features of it will slowly become worse over time. History backs me up on this.

And honestly, for something as fundamental as 2FA we should be using self hosted and open source tools without any corporate ties anyways.

This was just the push I needed to make that happen (Aegis).

burnJS4• 2 years ago

I sent them a support request venting. Will this work? Unlikely, but it takes less than a minute once you move through their automated help flow clicking "no not helpful"

https://support.authy.com/hc/en-us

gorkish• 2 years ago

I regret immensely that I ever endorsed or recommended Authy.

My experience witnessing the regression and functional decline of this app over the years has utterly wrecked my opinion of Twilio. Although I still have a couple of operational Twilio integrations, I no longer have any desire to use any of their products or services ever again.

Delogrand• 2 years ago

2FAS Auth is fully exportable and you can even modify any of your token settings natively in the app.

12700180802• 2 years ago

They don't have a desktop app.

genevra2• 2 years ago

I'm unsure what to switch to as another easy to use desktop cloud based 2factor app that's encrypted

I liked the peace of mind of having it in the cloud so I don't randomly lose all of my accounts if I decide to replace my phone

This is extremely disappointing, I don't trust many other companies and this is a baffling decisio

EVa5I7bHFq9mnYK• 2 years ago

Good, because it encouraged bad security practice - running both parts of 2fa on the same device.

alexwasserman• 2 years ago

Handily on macos the iOS version runs and is still supported.

I ran both side by side to log into the iOS version after downloading it on my MacBook.

Login was easy and everything came over. Just had to turn on multi-device, log in on the new app, then turn it off again.

Most of my TOTP is in 1Password, but for apps the require Authy integration the iOS version seems fine.

JSR_FDED• 2 years ago

Even though I only use their iOS version I'm not taking any chances with something as important as this, so decided to ditch Authy on the phone. I looked at a few alternatives, and was pleasantly surprised at the built-in option on iOS and MacOS (and they automatically stay synced between phone and Mac if you're on iCloud).

Instead of trying to extract the settings out of Authy, I simply visited each of the sites for which I have 2FA turned on, logged in with the Authy code (for the last time), went to the account config/profile section of the web page and chose "Setup new authenticator" (or similar). Then it shows you a new QR code. At this moment on your iPhone you switch to the Passwords app which is under Settings->Passwords and search for the website or enter a new record. Then click on "Set Up Verification Code", and choose the option to scan the QR code. That's all there's to it. From then on you can log in either from your iPhone or Mac, and doing the fingerprint/FaceId will enter the TOTP code.

Tip: After making the change on each website, open an incognito/private browsing window and log in again. That way old cookies can't mess things up. I found one site where the re-doing of the 2FA hadn't worked properly this way.

drcongo• 2 years ago

I wish they'd kill Authy altogether. It's a terrible app and one particular service I use will only allow Authy for 2FA.

jrochkind1• 2 years ago

Nobody seems to have commented that they just bumped the EOL for Authy Desktop from August to March. With only weeks before the new EOL?

End of Life for Twilio Authy Desktop App

Related Stories