Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

End of Life for Twilio Authy Desktop App

help.twilio.com

Post reply on HN
Print view View original

161–170 of 180 posts

Re: End of Life for Twilio Authy Desktop App

#161

Post by fauigerzigerk »

powersnail wrote: post #138
fauigerzigerk wrote: post #67

Earlier quoted context omitted.

>In what cases would your password vault be compromised, but your TOTP vault still be secure? If the password vault is on one device and the TOTP app on another then it would be harder for an attacker to get into both. I have the same concerns about passkeys. How is it secure if the only thing an attacker needs is a single method of accessing a single device?

> How is it secure if the only thing an attacker needs is a single method of accessing a single device? You should have two-factor for your password vault as well, and that TOTP is stored on a separate device. In other words, you replace the model of having password+TOTP for every account, to having one password+TOTP for your password vault, and effectively treat that password vault as an authentication service for y…

That's a good idea.

Now I just have to find out how to configure this for passkeys.

Re: End of Life for Twilio Authy Desktop App

#162

Post by protonmail »

drpossum wrote: post #6
polyvisual wrote: post #5

Earlier quoted context omitted.

I use Authy. I've read a few comments about how migrating away is difficult. What do you use instead? I also use bitwarden, but not sure how I feel about passwords and totp being in the same app.

I've moved over to Proton Pass (you can do TOTP on the desktop through a browser, I figured if I'm authenticating into a site I must have internet) but KeepassXC was a strong contender. Both have excellent mobile support and Keepass has native desktop clients. Proton Pass isn't free, though, but I already had their services.

Happy to hear you've switched to our password manager! Just to clarify, you can use Proton Pass for free too: https://proton.me/pass/free.

Re: End of Life for Twilio Authy Desktop App

#163

Post by ckcheng »

jorvi wrote: post #117
vanilla_nut wrote: post #16

Earlier quoted context omitted.

Two ways: - a Yubikey - a sparingly used email account with no 2FA, just a very long password 2FA through the sort-of-secret email account lets me get back into Bitwarden (and thus everything else) even if my house burns down and I lose access to all of my yubikeys. And auth on a device that doesn't easily support yubikeys, like older iPhones. 2FA is very useful, but highly overrated. If you have a sufficiently long…

> 2FA is very useful, but highly overrated. What a bizarre statement. It protects you from any password leak. If you have 2FA, even if you get keylogged or phished or breached or shoulder peeked, your intruder still does not gain access.

Apparently MFA in practice mainly protects against credential stuffing:

https://hn.algolia.com/?dateEnd=1705017600&dateRange=custom&...

Re: End of Life for Twilio Authy Desktop App

#165

Post by notpushkin »

tadfisher wrote: post #111
notpushkin wrote: post #35

Earlier quoted context omitted.

Password Store works fine for me: https://www.passwordstore.org/ https://github.com/tadfisher/pass-otp Others have also said Bitwarden isn't too bad: https://bitwarden.com/

> https://github.com/tadfisher/pass-otp Seconded. The jerk maintainer needs to cut a release though. And maybe port it to something other than bash.

Don't be too harsh on him, he's doing his best :D

(Seriously though, thank you, it's been incredibly useful so far!)

Re: End of Life for Twilio Authy Desktop App

#166

Post by [deleted] »

latchkey wrote: post #2

They intentionally make it really hard to migrate your data off their app under the premise of "security". Now, they are EOL'ing desktop apps, which are extremely convenient to use, despite the terrible UX. https://support.authy.com/hc/en-us/articles/1260805179070-Ex... The process for exporting is doable, but requires fairly deep technical knowledge and it isn't 100% clean. In order to do so, you need that desktop a…

[deleted]

Re: End of Life for Twilio Authy Desktop App

#167

Post by Delogrand »

gorkish wrote: post #135

I regret immensely that I ever endorsed or recommended Authy. My experience witnessing the regression and functional decline of this app over the years has utterly wrecked my opinion of Twilio. Although I still have a couple of operational Twilio integrations, I no longer have any desire to use any of their products or services ever again.

2FAS Auth is fully exportable and you can even modify any of your token settings natively in the app.

Re: End of Life for Twilio Authy Desktop App

#168

Post by jdeibele »

egwynn wrote: post #22
latchkey wrote: post #2

They intentionally make it really hard to migrate your data off their app under the premise of "security". Now, they are EOL'ing desktop apps, which are extremely convenient to use, despite the terrible UX. https://support.authy.com/hc/en-us/articles/1260805179070-Ex... The process for exporting is doable, but requires fairly deep technical knowledge and it isn't 100% clean. In order to do so, you need that desktop a…

I had some good luck with https://github.com/token2/authy-migration

I used this and it worked very well. Not perfectly.

Because Authy doesn't have icons for a lot of services, I stored info as twitter:username, google:username, etc. The script dropped about the service name on about 10 of those, just showing the username.

I "imported" the list of QR codes into 2FAS by using my iPhone's camera. Where there wasn't a service, it would say "Service 1", "Service 2", etc.

I then went back through with 2FAS on one device and Authy on another, matching the "Service 1" to "Bubble", for example, because the TOTP codes were the same.

The one service that didn't seem to transfer was Facebook, which I have in Authy but didn't show up in the QR code list.

Several codes in Authy were duplicates, meaning that service:username was the same. 2FAS asked if I wanted to overwrite them. #1, I don't think Authy should allow the same string more than once and #2, again, a simple alphabetization would make maintaining and using Authy more agreeable.

Re: End of Life for Twilio Authy Desktop App

#169

Post by jdeibele »

jdeibele wrote: post #168
egwynn wrote: post #22

Earlier quoted context omitted.

I had some good luck with https://github.com/token2/authy-migration

I used this and it worked very well. Not perfectly. Because Authy doesn't have icons for a lot of services, I stored info as twitter:username, google:username, etc. The script dropped about the service name on about 10 of those, just showing the username. I "imported" the list of QR codes into 2FAS by using my iPhone's camera. Where there wasn't a service, it would say "Service 1", "Service 2", etc. I then went back…

Actually, it looks like Authy will show "twitter:username" in the compact list but doesn't show that (just "username") on the icon view unless I'd manually added them. So it wasn't stripping service names, I hadn't added them.

Still puzzled about why Facebook wasn't transferred.

I have found Authy to be reliable and I like having the TOTP codes on multiple devices. I have a powered-off iPhone at a friend's as one way to access my codes. I don't like the apathy that Twilio has shown it and I don't like the inability to export.

Re: End of Life for Twilio Authy Desktop App

#170

Post by mejthemage »

notpushkin wrote: post #35
metadat wrote: post #21

Earlier quoted context omitted.

What should I replace it with? Any recommendations for a functionally equivalent cross-device 2FA app?

Password Store works fine for me: https://www.passwordstore.org/ https://github.com/tadfisher/pass-otp Others have also said Bitwarden isn't too bad: https://bitwarden.com/

I see other replies also recommending password managers

Why would I store my second authentication factor alongside the first? Aren't we effectively now back to 1FA?

Post reply on HN