> Twilio, Authy’s parent company, is also moving Authy’s customer support hub to the help center on Twilio’s website after January 15th, 2024.
> Twilio says it made the decision to sunset its desktop app to “streamline our focus and provide more value on existing product solutions for which we see increasing demand.” The company laid off 5 percent of workers in December 2023, and it just announced on Monday that it has replaced its CEO.
Ironically, I was planning to move from Google Authenticator to Authy precisely because Authy had a desktop app. Oh well, that's one less thing for me to do, and one less user for Authy!
Some password managers allow you to do 2FA autofill, I’ve been moving mine into 1password, but when it doesn’t autofill it isn’t as fast to go pull it up manually as it was with authy, still worth it overall, though
On Windows, you can use a variety of Android 2FA apps. With a bit of messing around, you may even be able to get the Authy Android app working. On other platforms, there's a variety of open source and not-so-open source TOTP apps you can use instead.
Authy does have some proprietary stuff (partnership with companies for auth push notifications, for example; I've seen this on Twitch) but most companies just use the TOTP/HOTP functionality that's available in all manner of apps.
Perhaps, but I don't think it should be a strict requirement. A locked-down, encrypted laptop with all of its keys stored securely in a TPM will do just fine when all you want to prevent is hackers from another country using credential stuffing to log into your online environment. It mostly depends on what kind of threads you're trying to defend against.
Then again, with passkeys and Windows Hello/TouchID becoming more and more usable in real life, I think the Authy app has better replacements available that are built right into the operating systems already.
The real kicker is Authy's sync feature; you're basically locking your 2FA behind a password and a phone number. It's another thing attackers need to hack, but it's inherently weaker for protecting access than the "hardware you need to destroy to get the secrets" types of second factors.
The second factor is not meant for securing you against a compromised system and if you really think about it you already lost mostly when your system is compromised (stealing sessions credentials etc). The second factor usage is to secure that you are really you and securing a service against external unknown logins.
The attack vector is the following: Somehow a hacker gets your username and maybe a password you use often or using an brute force attack on an internet service. The second factor basically asking: Is that really you? When the second factor is on the same device (which you own) then that's also a valid way to say "yes, it's really me".
Also think about it: When you login on a phone browser or phone app both things are on the same device. Same logic.
This seems like the perfect opportunity to plug the Windows authenticator app I've written: https://github.com/PeterReid/toptyp/blob/master/README.md . It looks and works somewhat like Authy Desktop does. It does not sync at all, though.
Darn. Use it on the regular for daily desktop ops.
What I don't understand is the need for a mobile device handy to access stuff on desktop. I mean I understand how that increases security but why isn't access to the app, which is basically locked behind the OS login/authentication a pretty good setup. Because a hacker already having access to the laptop invalidates it? In a stolen/compromised desktop scenario I can still access my 2fa synced on mobile and lock them out no?
Is there _anything_ else available that can run on multiple platforms including desktop, and sync your stuff between them?
I really want to have access to the codes on my desktop AND I _need_ multi-device syncing -- I am absolutely unwilling to be in a state where losing a device loses me access to everything (unless I have all my "backup codes" which i definitely will never).
I'm of the opinion that Authy should be sunset in favor of TOTP. It's required use in Twitch is deeply problematic. There's just no space for this sort of solution with TOTP authenticators being far more ubiquitous, and open.
I thought Authy was a TOTP authenticator? I thought I was using it as an "Authenticator App" in places that require a TOTP authenticator, and can use any TOTP authenticator implementation, and Authy is the one I was using.
But this stuff confuses me, I am not shocked if i'm wrong. Can you explain where I'm going wrong, or provide a link to help me understand it?
I don't use Twitch; it sounds like maybe Twitch doesn't let you use any TOTP authenticator, but _requires_ you to use Authy? (weird!) But maybe Authy is still a TOTP authenticator?
Authy supports TOTP, but it also provides it's own proprietary secret TOTP alternative, and that's what Twitch uses unless something has changed. You cannot use anything other than Authy for Twitch.
31 comments
[ 1.6 ms ] story [ 80.8 ms ] thread> Twilio says it made the decision to sunset its desktop app to “streamline our focus and provide more value on existing product solutions for which we see increasing demand.” The company laid off 5 percent of workers in December 2023, and it just announced on Monday that it has replaced its CEO.
Not looking forward to having to type codes vs copy-paste..
Authy does have some proprietary stuff (partnership with companies for auth push notifications, for example; I've seen this on Twitch) but most companies just use the TOTP/HOTP functionality that's available in all manner of apps.
iOS: ente
PC: 1Password, Bitwarden, KeePass
Then again, with passkeys and Windows Hello/TouchID becoming more and more usable in real life, I think the Authy app has better replacements available that are built right into the operating systems already.
The real kicker is Authy's sync feature; you're basically locking your 2FA behind a password and a phone number. It's another thing attackers need to hack, but it's inherently weaker for protecting access than the "hardware you need to destroy to get the secrets" types of second factors.
The attack vector is the following: Somehow a hacker gets your username and maybe a password you use often or using an brute force attack on an internet service. The second factor basically asking: Is that really you? When the second factor is on the same device (which you own) then that's also a valid way to say "yes, it's really me".
Also think about it: When you login on a phone browser or phone app both things are on the same device. Same logic.
What I don't understand is the need for a mobile device handy to access stuff on desktop. I mean I understand how that increases security but why isn't access to the app, which is basically locked behind the OS login/authentication a pretty good setup. Because a hacker already having access to the laptop invalidates it? In a stolen/compromised desktop scenario I can still access my 2fa synced on mobile and lock them out no?
If I decided that it was worth the risk, then I'd probably use 1Password's 2FA integration instead.
Is there _anything_ else available that can run on multiple platforms including desktop, and sync your stuff between them?
I really want to have access to the codes on my desktop AND I _need_ multi-device syncing -- I am absolutely unwilling to be in a state where losing a device loses me access to everything (unless I have all my "backup codes" which i definitely will never).
Any suggestions?
If I wanted to pay, looks like 1password also does it. (Or if I already had 1password which I should prob have anyway).
But this stuff confuses me, I am not shocked if i'm wrong. Can you explain where I'm going wrong, or provide a link to help me understand it?
I don't use Twitch; it sounds like maybe Twitch doesn't let you use any TOTP authenticator, but _requires_ you to use Authy? (weird!) But maybe Authy is still a TOTP authenticator?