Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

End of Life for Twilio Authy Desktop App

help.twilio.com

Post reply on HN
Print view View original

151–160 of 180 posts

Re: End of Life for Twilio Authy Desktop App

#151

Post by stephenr »

Dalewyn wrote: post #45

As someone who just uses good old passwords managed with TXT files and sticky notes: Security engineers (marketers?) never seem to understand most people by far value convenience over security.

... I can't comment on the tool in the article because I've never used it, but I'm pretty confident a good password manager is more convenient than text files or sticky notes, while being more secure.

But also I think you're being naïve if you think security(-adjacent) people don't understand that people often prefer convenience.

The entire concept of a password manager is about convenience. Why do you think most mobile devices default to asking for a PIN code rather than a password? Why do you think credit/debit cards use a PIN rather than a complex password?

Convenience. It's literally all to make things more convenient.

Re: End of Life for Twilio Authy Desktop App

#153

Post by hnbear »

Handily on macos the iOS version runs and is still supported.

I ran both side by side to log into the iOS version after downloading it on my MacBook.

Login was easy and everything came over. Just had to turn on multi-device, log in on the new app, then turn it off again.

Most of my TOTP is in 1Password, but for apps the require Authy integration the iOS version seems fine.

Re: End of Life for Twilio Authy Desktop App

#154

Post by mos_basik »

nucleardog wrote: post #116
gregmac wrote: post #38

Earlier quoted context omitted.

> I also use bitwarden, but not sure how I feel about passwords and totp being in the same app. I guess this depends on your threat model. In what cases would your password vault be compromised, but your TOTP vault still be secure? If someone gets access to your unlocked PC/phone, don't they then have access to both? Do you store your TOTP vault password in your password vault (obvious)? If someone gets into your pas…

> I guess this depends on your threat model. In what cases would your password vault be compromised, but your TOTP vault still be secure? Key logger? I unlock my password vault frequently. I only unlock my TOTP vault to: 1. Add a new secret 2. Recover access to an account if my authenticator has died. Since I unlock my TOTP vault so infrequently, the number of hashing rounds/etc are tuned to be _much_ slower and requ…

ahhhhhhhhhhh!

Wow, this might be the answer to a question that's been bugging me for a while!

It didn't seem right to keep all of my TOTP secrets isolated on one easily lost/stolen/broken device (phone), so when I realized KeePass supported generating TOTP codes I moved all my TOTP secrets into my password database (which is synced around all my devices) then deleted the single-purpose authenticator app as unnecessary.

But then it didn't seem right to have all of my TOTP secrets live in my normal vault with my credentials since that loses the "second factor". Nor did it seem like it would help to make a separate database for TOTP secrets and sync it around too - still no second factor, plus added friction to open both databases on every login.

But as you say, I could keep TOTP secrets in two places - in an authenticator app on my phone with no syncing for daily use (keeps the two-factorness cause it's on a single device, and is low friction cause it piggybacks on the security of my phone and doesn't require a separate login) AND in a TOTP specific password database that's synced around but opened only rarely (in the cases you described).

Thanks for the hint about tuning hashing rounds; didn't know that could be configurable! Looks like KeePass supports that too; I'll look into that.

Re: End of Life for Twilio Authy Desktop App

#155

Post by pseufaux »

ijustlovemath wrote: post #77

Can anyone recommend an alternative with similar ux? I use it almost every day, it's very convenient for me! I don't always have my phone around, and also have used it more than once to prevent being locked out of a service

I've been happy with Ente Auth

https://github.com/ente-io/auth

Re: End of Life for Twilio Authy Desktop App

#156

Post by memset »

kevinsky wrote: post #17

I migrated to 2FS as I wanted to keep my MFA secrets separate from my BitWarden passwords. It does require some technical knowledge but the how to was thorough and is found here https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d... Best to get it done quickly before they prevent you from downloading the older version that had the debug console

Thanks for posting this, just followed the steps on mac and everything worked perfectly.

Re: End of Life for Twilio Authy Desktop App

#157

Post by ChrisArchitect »

gnabgib wrote: post #149
ChrisArchitect wrote: post #18

Earlier quoted context omitted.

That one was just another discussion a month ago, might have some extra tips for alternatives etc. This one is fine, official, and was first for today.

Naa, the official source was posted 36 days ago: [0], the one you reference was a more popular dupe posted 7 hours later from a lesser source that referenced the original. [0]: https://news.ycombinator.com/item?id=38916798

Good job. In this case wasn't really looking for the src but rather pointing to the older discussion for ppl looking for next steps/solutions. Wherever the discussion was then.

Re: End of Life for Twilio Authy Desktop App

#158

Post by hax0r1 »

noman-land wrote: post #139
ejb999 wrote: post #61

Earlier quoted context omitted.

I agree, seems short-sighted - they could have even just started charging a bit for it to keep it alive if necessary. No surprise though, after a fantastic start, twilio has turned into a sh*t company, unfortunately - I was a very early adaptor of many of their tools and services, and 1 by 1, they have all gone downhill. They should have sold the company while it still had a decent reputation, at this rate there will…

Twilio has taken a nosedive recently. Do you have any suggested alternatives for programmatic voice and text?

https://www.plivo.com/twilio-alternative/

Re: End of Life for Twilio Authy Desktop App

#159

Post by JSR_FDED »

Even though I only use their iOS version I'm not taking any chances with something as important as this, so decided to ditch Authy on the phone. I looked at a few alternatives, and was pleasantly surprised at the built-in option on iOS and MacOS (and they automatically stay synced between phone and Mac if you're on iCloud).

Instead of trying to extract the settings out of Authy, I simply visited each of the sites for which I have 2FA turned on, logged in with the Authy code (for the last time), went to the account config/profile section of the web page and chose "Setup new authenticator" (or similar). Then it shows you a new QR code. At this moment on your iPhone you switch to the Passwords app which is under Settings->Passwords and search for the website or enter a new record. Then click on "Set Up Verification Code", and choose the option to scan the QR code. That's all there's to it. From then on you can log in either from your iPhone or Mac, and doing the fingerprint/FaceId will enter the TOTP code.

Tip: After making the change on each website, open an incognito/private browsing window and log in again. That way old cookies can't mess things up. I found one site where the re-doing of the 2FA hadn't worked properly this way.

Re: End of Life for Twilio Authy Desktop App

#160

Post by fauigerzigerk »

lamontcg wrote: post #112
fauigerzigerk wrote: post #83

Earlier quoted context omitted.

>Generally the threat model that TOTP protects against is not someone breaking into your device. And yet, in some realistic scenarios TOTP does protect me against that, if the second factor is on a different device, kind of like a poor man's yubikey.

Not if I'm on your device and hijacking your already-authenticated connection. I just need to be careful enough to do it in the background in such a way that you don't notice.

If my device got stolen I would remove the device from my accounts immediately. And without the second factor you wouldn't be able to do anything about it.
Post reply on HN