Can anyone with experience give an estimate of the acquisition price?
Authy is joining Twilio
31–40 of 73 posts
Re: Authy is joining Twilio
#32Earlier quoted context omitted.
Why does Authy require I provide my cell phone number and email address? Why do I have to have a user account? This is completely ridiculous. I do not need nor want cloud syncing or backup. You are making Authy a potential target for attacks by associating a user to cloud stored 2FA information. This is not in the spirit of 2FA.
Hi, good question. The reason for the phone number is that we depend on your phone number as part of your identity. Almost all 2-FA systems today use the phone number as a way to send you the code via text/phone call. If you read my blog post: blog.authy.com/twilio you'll see we decided to build our infrastructure on top of the telecom infrastructure because it was ubiquitous. I also understand why some people don't…
Is that method of sending the Authy authentication code any more secure than all the "regular" SMS-based 2FA methods (like say Gmail's SMS-based 2FA)? If so, how?
I think Google's (or Microsoft's because I think they use a similar SMS-based 2FA) method could be easily manipulated by intelligence agencies for example with access to the carriers' networks. The Google Authenticator app is now completely useless for Gmail as well, since they made it to fallback to SMS-based 2FA if you forgot your password (ugh - why Google? WHY?!).
Re: Authy is joining Twilio
#33Earlier quoted context omitted.
Why does Authy require I provide my cell phone number and email address? Why do I have to have a user account? This is completely ridiculous. I do not need nor want cloud syncing or backup. You are making Authy a potential target for attacks by associating a user to cloud stored 2FA information. This is not in the spirit of 2FA.
Hi, good question. The reason for the phone number is that we depend on your phone number as part of your identity. Almost all 2-FA systems today use the phone number as a way to send you the code via text/phone call. If you read my blog post: blog.authy.com/twilio you'll see we decided to build our infrastructure on top of the telecom infrastructure because it was ubiquitous. I also understand why some people don't…
"identity" isn't part of the 2FA concept (nor should it be)--you're shoehorning in something that doesn't belong.
Re: Authy is joining Twilio
#34> "There are few companies who share our dedication to excellence…"
Authy is one of the worst-designed iOS applications I have ever used. It has been this way for a very long time. They are actively hostile to people who try to criticize their poor design choices. I would not classify it as "dedicated to excellence."
CloudFlare forces me to keep it installed, so I have to interact with it on occasion. If you have more than about 3 services set up, you have to first scroll to expand the scrolling list of icons, then scroll multiple times to find and read the 10pt font name of a service, etc. It's awful. Compare it to Google Authenticator, which has a nice, big scrolling list of numbers and names. The one advantage Authy has is encrypted backup, which I like, and service lock-in, which annoys me.
Perhaps there's hope in somebody else taking over. Please, Twilio: prioritize _usability_.
Re: Authy is joining Twilio
#35Earlier quoted context omitted.
This tweet indicates you're using TOTP, slightly modified from Google's implementation: https://twitter.com/authy/status/498244613766139904 @benmcginnes Yes we are RFC 6238 TOTP compatible. Same algorithm as GAuth but 7 digits, 256 bit keys and 10 seconds window. So why do you still need my phone number? There's no network connection or SMS required to generate those TOTP codes. I'm not buying the story that you need…
For those interested in how TOTP is implemented, here it is in Python [1] and Ruby [2]. It is really simple and understandable. Oh, and did you know you can secure your SSH connections using TOTP [3]? This stuff is no more complicated than storing password hashes. Having a nice client app is good, but Google Authenticator is good enough. So instead of using authy and relying on a third party, why not get something li…
Oh thanks for mentioning [4], I always thought 2FA using PAM disabled the key-based authentication and used passwords.
Re: Authy is joining Twilio
#36Earlier quoted context omitted.
Authy exists to make 2 factor easier for people implementing it. Some users will want methods other than TOTP, so they support methods other than TOTP. If they don't have a phone number they can't do all that transparently, which is bad when you are aiming your service at a broad audience.
Then why not allow users to defer entering a phone number until they try to add a service that actually requires it?
Because doing a high enough level of identity verification at that point would be disruptive.
I'm not really interested in defending it, I probably don't like the idea of depending on a third party any more than feld does, I was just pointing out that there are simpler explanations for what they are doing than I'm not buying the story that you need to text me or call me unless you're storing the seed/token centrally and sending it to users upon request which I strongly disagree with.
Another one is that if they actually implemented TOTP like that their business would take a lot of damage when it was revealed publicly (because what's the point of paying for a broken implementation?).
Re: Authy is joining Twilio
#37Earlier quoted context omitted.
This tweet indicates you're using TOTP, slightly modified from Google's implementation: https://twitter.com/authy/status/498244613766139904 @benmcginnes Yes we are RFC 6238 TOTP compatible. Same algorithm as GAuth but 7 digits, 256 bit keys and 10 seconds window. So why do you still need my phone number? There's no network connection or SMS required to generate those TOTP codes. I'm not buying the story that you need…
Ok, serious question: how do you manage your tokens? What happens if your device flies out of the window? A couple of months ago I managed to break the screen of my tablet with 20-30 services I use 2FA (Google Authenticator). I had to spend about 50 bucks just to get a new screen and repair it. For some of these services I had the token saved on my keepass, but I always felt a little dirty doing that. If there was a…
You print off a list of backup codes and stick them in a safe. Then log in with the backup code, and set up a new Authenticator token.
You could also add a U2F token and store that away.
Re: Authy is joining Twilio
#38> "There are few companies who share our dedication to excellence…" Authy is one of the worst-designed iOS applications I have ever used. It has been this way for a very long time. They are actively hostile to people who try to criticize their poor design choices. I would not classify it as "dedicated to excellence." CloudFlare forces me to keep it installed, so I have to interact with it on occasion. If you have mor…
On Android, it's attractive, functional, and lets me quickly switch between services. I'm not sure what it could do better.
FWIW, I have 4 services set up on it.
Re: Authy is joining Twilio
#39> "There are few companies who share our dedication to excellence…" Authy is one of the worst-designed iOS applications I have ever used. It has been this way for a very long time. They are actively hostile to people who try to criticize their poor design choices. I would not classify it as "dedicated to excellence." CloudFlare forces me to keep it installed, so I have to interact with it on occasion. If you have mor…
Have you not updated in a while? For me it works fine. I see all the icons for all of my services all the time. Click the one I want and get the number. No Scrolling required.
Current screenshot http://i.imgur.com/EzNc2g9.jpg
Re: Authy is joining Twilio
#40> "There are few companies who share our dedication to excellence…" Authy is one of the worst-designed iOS applications I have ever used. It has been this way for a very long time. They are actively hostile to people who try to criticize their poor design choices. I would not classify it as "dedicated to excellence." CloudFlare forces me to keep it installed, so I have to interact with it on occasion. If you have mor…
Have you not updated in a while? For me it works fine. I see all the icons for all of my services all the time. Click the one I want and get the number. No Scrolling required. Current screenshot http://i.imgur.com/EzNc2g9.jpg
[deleted]