https://support.authy.com/hc/en-us/articles/1260805179070-Ex...

The process for exporting is doable, but requires fairly deep technical knowledge and it isn't 100% clean. In order to do so, you need that desktop app and a specific version at that.

https://www.reddit.com/r/Bitwarden/comments/116kpvf/export_a...

I stopped using it ages ago because of these reasons, this should be your heads up to do the same.

If you migrate to another app and then delete your authy account, you risk having 2FA removed for some integrated accounts if they're set up to directly use the Authy backend. Twitch in some cases was pointed out.

To add another reason: their API will return an error if you send it more than one simultaneous request.

Once they got bought out & forced their poorly implemented 2fa with mobile phone requirements, I had no choice but to find different providers.

Because Authy doesn't have icons for a lot of services, I stored info as twitter:username, google:username, etc. The script dropped about the service name on about 10 of those, just showing the username.

I "imported" the list of QR codes into 2FAS by using my iPhone's camera. Where there wasn't a service, it would say "Service 1", "Service 2", etc.

I then went back through with 2FAS on one device and Authy on another, matching the "Service 1" to "Bubble", for example, because the TOTP codes were the same.

The one service that didn't seem to transfer was Facebook, which I have in Authy but didn't show up in the QR code list.

Several codes in Authy were duplicates, meaning that service:username was the same. 2FAS asked if I wanted to overwrite them. #1, I don't think Authy should allow the same string more than once and #2, again, a simple alphabetization would make maintaining and using Authy more agreeable.

Still puzzled about why Facebook wasn't transferred.

I have found Authy to be reliable and I like having the TOTP codes on multiple devices. I have a powered-off iPhone at a friend's as one way to access my codes. I don't like the apathy that Twilio has shown it and I don't like the inability to export.

I also use bitwarden, but not sure how I feel about passwords and totp being in the same app.

I guess this depends on your threat model. In what cases would your password vault be compromised, but your TOTP vault still be secure?

If someone gets access to your unlocked PC/phone, don't they then have access to both? Do you store your TOTP vault password in your password vault (obvious)?

If someone gets into your password vault, why wouldn't the same mechanism also let them get into your TOTP vault? (This applies whether it's brute force, keylogger, hardware exploit, or $5 wrench.)

If Bitwarden is compromised, like LastPass was. Of course the vault should still be encrypted, but I don't want to rely on a single company managing everything correctly. It seems much less likely that two different companies will be compromised at the same time.

If the password vault is on one device and the TOTP app on another then it would be harder for an attacker to get into both.

I have the same concerns about passkeys. How is it secure if the only thing an attacker needs is a single method of accessing a single device?

And yet, in some realistic scenarios TOTP does protect me against that, if the second factor is on a different device, kind of like a poor man's yubikey.

You should have two-factor for your password vault as well, and that TOTP is stored on a separate device.

In other words, you replace the model of having password+TOTP for every account, to having one password+TOTP for your password vault, and effectively treat that password vault as an authentication service for yourself.

Now I just have to find out how to configure this for passkeys.

I use Authy with Face ID protecting the entire app on my phone. I don't use the Desktop app because it won't use Touch ID, meaning I have to type in a long master password.

I don't see an attack as likely to happen (I own no Bitcoin, not a billionaire, not in charge of anyone else's secrets) but if there was a flaw that let somebody access the passwords on my Mac or iPhone, they'd still need the 2FA codes from my phone. I think that's more likely to happen on the Mac because I do have apps downloaded from somewhere else besides Apple's App Store.

My guess is that most of the people who worked on Authy have fallen by the wayside after the Twilio acquisition. It's annoying every time I have to search the boxes on my phone or the list on my watch: can't we please have alphabetization?

Key logger?

I unlock my password vault frequently. I only unlock my TOTP vault to:

1. Add a new secret 2. Recover access to an account if my authenticator has died.

Since I unlock my TOTP vault so infrequently, the number of hashing rounds/etc are tuned to be _much_ slower and require _much_ more memory. It uses an entirely separate set of credentials from my main vault. And you're unlikely to snag the password unless you're watching me for a long time or get very lucky.

Wow, this might be the answer to a question that's been bugging me for a while!

It didn't seem right to keep all of my TOTP secrets isolated on one easily lost/stolen/broken device (phone), so when I realized KeePass supported generating TOTP codes I moved all my TOTP secrets into my password database (which is synced around all my devices) then deleted the single-purpose authenticator app as unnecessary.

But then it didn't seem right to have all of my TOTP secrets live in my normal vault with my credentials since that loses the "second factor". Nor did it seem like it would help to make a separate database for TOTP secrets and sync it around too - still no second factor, plus added friction to open both databases on every login.

But as you say, I could keep TOTP secrets in two places - in an authenticator app on my phone with no syncing for daily use (keeps the two-factorness cause it's on a single device, and is low friction cause it piggybacks on the security of my phone and doesn't require a separate login) AND in a TOTP specific password database that's synced around but opened only rarely (in the cases you described).

Thanks for the hint about tuning hashing rounds; didn't know that could be configurable! Looks like KeePass supports that too; I'll look into that.

Proton Pass isn't free, though, but I already had their services.

I felt the same way and I've come to realize that it is not a big deal. One advantage is that with a shared password manager account, you can also share the TOTP along with it. Very convenient for a bunch of usecases.

It does mean you're putting a lot of trust in your password manager, but on the other had, you already kind of were, weren't you?

It is also buggy af and doesn't sync properly. He's pretty much not doing any more updates of the app either.

That experience pushed me off it forever.

Edit: The app has been acquired by a third party. I'd move off it.

https://www.reddit.com/r/privacy/comments/158ihxd/raivo_auth...

I decided to create a private backup which I control and so I built a client-side web app that encrypts QR codes (like 2FA codes). It was inspired by a similar CLI based project I saw here on HN. I still use Authy (for now) but now I have encrypted images that I can decrypt and rescan easily. And since they're just images I saved them in various places and even printed out copies should I lose my phone or Authy access.

To 'migrate' my codes out of Authy I just went through each site and regenerated the codes (plus encrypted them). It's annoying that they force you to do this but doesn't take too long.

I'm still polishing it up but it works well and I would love some feedback if there's anyone who finds it useful - https://encrypt-qr-codes.netlify.app/

https://github.com/tadfisher/pass-otp

Others have also said Bitwarden isn't too bad: https://bitwarden.com/

Seconded. The jerk maintainer needs to cut a release though. And maybe port it to something other than bash.

(Seriously though, thank you, it's been incredibly useful so far!)

Why would I store my second authentication factor alongside the first? Aren't we effectively now back to 1FA?

Adding TOTP on top of that helps guard a bit more against some kinds of attacks. You can make it even stronger by not storing those keys in the same place and only using your phone, for example, but for some people (myself included) it's one bit too inconvenient. The good thing about using TOTP for 2FA is that you can find your own balance between convenience and security.

https://2fas.com/

What does 2FAS give, genuinely curious in case I'm missing something..

If you have an ARM Mac you can install the Authy iPad app and use it just like the Desktop app.

If you want to have a desktop backup but aren't ready to migrate yet, this is a fantastic stop-gap solution.

[0] https://news.ycombinator.com/item?id=39360950

https://support.apple.com/guide/iphone/automatically-fill-in...

https://support.apple.com/guide/icloud-windows/set-up-icloud...

CLI: https://developer.1password.com/docs/cli/get-started/

Shell plugins: https://developer.1password.com/docs/cli/shell-plugins

Secrets automation: https://developer.1password.com/docs/secrets-automation

No surprise though, after a fantastic start, twilio has turned into a sh*t company, unfortunately - I was a very early adaptor of many of their tools and services, and 1 by 1, they have all gone downhill.

They should have sold the company while it still had a decent reputation, at this rate there will be nothing of worth left.

I switched to them after my phone died and I saw how hard accessing my accounts was without a backup OTP device.

Really? What do people use desktops for then? Why doesn't everyone just use phones and Chromebooks?

There's no point in buying a desktop if you aren't going to run software on it.

https://support.apple.com/en-us/102430

> Note: The iOS app will also be available to download on M1/M2 powered Apple Mac devices.

- a Yubikey - a sparingly used email account with no 2FA, just a very long password

2FA through the sort-of-secret email account lets me get back into Bitwarden (and thus everything else) even if my house burns down and I lose access to all of my yubikeys. And auth on a device that doesn't easily support yubikeys, like older iPhones.

2FA is very useful, but highly overrated. If you have a sufficiently long and complex memorized password (and the email platform actually lets you create one that's properly long, 40+ characters), it's unlikely that you'll have any problems unless you accidentally share the password somewhere.

Of course I feel like all my my precautions are moot when my bank and CC company force SMS 2FA. But I haven't found any with superior security schemes anwyway.

https://www.reddit.com/r/mintmobile/comments/104h7p2/locked_...

seems like some senior CSRs can still get you bypassed.

What a bizarre statement. It protects you from any password leak.

If you have 2FA, even if you get keylogged or phished or breached or shoulder peeked, your intruder still does not gain access.

https://hn.algolia.com/?dateEnd=1705017600&dateRange=custom&...

You're generally correct, though: GOOD 2FA is not overrated and I would welcome it on any account. But it's obnoxious that almost every account I have uses SMS as a singular point of failure. I'd welcome a move back to email 2FA with a backup email for account recovery.

[1] https://getaegis.app/

There 100% has to be a way for the user to own + backup their own private key material, or these are all just paths for stronger lockin.

Personally, I have a TOTP App (andOTP) with QRCodes on paper in cold storage, keepass-based tools for passwords across platforms, and Syncthing for syncing across these systems.

The closest you can currently get is an open-source authenticator implementation that lets you export its credentials, like e.g. Bitwarden does (it supposedly lets you export WebAuthN credentials via JSON, but I haven't tried it myself).

I get that any UI way to let users export credentials is a potential phishing/social engineering avenue, but the lock-in danger is real, and I'm holding back on WebAuthN as my primary authentication method for now.

https://support.authy.com/hc/en-us/articles/17592416719003-A...

> Note: The iOS app will still be available to download on M1/M2 powered Apple Mac devices.

It does work, but it's not first class support, though. You have to enable alternative touch settings if you want do the "drag to the left to delete a token"

https://www.cxtoday.com/data-analytics/the-purge-continues-t...

While I do not know whether its UX is similar, it does have a sync feature (but not cross-browser), an export feature, can backup its data to Google Drive, can store everything encrypted (but not by default), is recommended by at least one government website (SSS Employer Portal in the Philippines), and is there for a long time. Oh, and it also remembers which site each secret comes from, and hides others.

The downside is no automatic synchronization with the mobile phone.

https://github.com/ente-io/auth

but seriously, what a terrible app, another great reason to get off that platform

Hadn't even thought of this, thank you!

(And it works!)

The desktop app solved this problem for me

.. and mods will probably delete this one.

[0]: https://news.ycombinator.com/item?id=38916798

Best to get it done quickly before they prevent you from downloading the older version that had the debug console

Does that mean Twilio has a financial interest in steering users away from using Authy?

From endless scrolling to hamburger menus, to straight up giving a big middle finger to having a desktop app.

I always present security as a sliding scale with secure on one side and convenient on the other. Similar to low-cost and convenient streaming services reducing piracy, and then seeing the return of piracy as they become higher cost and less-convenient, any application needs to consider not only how to protect its users and their data, but also how to not drive away users with security measures that encroach into that inconvenient zone.

2FA can definitely approach that zone in a few different ways eg. having to reauthenticate too often, or especially for technical users in situations where account sharing is a reality that isn't going away anytime soon: by not making your secret tokens readily available. It has been evident for years that Twilio was just trying to force vendor lock-in and I've always hated Authy. The desktop app at least gave you some agency (secrets on a device that you own and fully control), but I guess that was too much too ask in the long term.

Aside: there are measures that increase security without affecting convenience (much). Take those first.

Additional Aside to the text file password cowboy: since moving into password managers (first lastpass, now bitwarden) I've found it to be more convenient (usually) and I have a lot more peace of mind about it. Maybe try it?

Services, IMO, have a duty to do their utmost in protecting customer security and privacy. Fortunately Passkeys are becoming more common and I’m hoping more folks will choose them since they’re way better than plain passwords.

The problem with choosing convenience now is that you don’t know what the future holds, and a good chunk of security is stuff that people don’t know becoming known, sometimes very publicly so.

Eg a new 0day in Firefox is found, exploited, and the passwords.txt is gone before the user patches it (admittedly likely since I am unsure if the OP is up for the inconvenience of frequent browser or critical software updates).

If you’ve ever had anything important of yours being hacked you’ll probably understand how shitty it is and how it’s worth the inconvenience. Modern password managers are very convenient though. I love not knowing a single one of my service passwords. Plus, my laptop being stolen is probably gonna still protect my passwords since 1Password does protect them at rest, pending brute-forcing the (very long) master password. None of this is true or exists for a plaintext file.

Even then, say OP doesn’t care about getting hacked and someone gets into their email. Now, the hacker has their email and contact lists. They can use that info to target OP’s contacts with more-viable phishing or other attacks.

I wonder if it will be his passwords, or one of the providers of those impenetrable password replacement keys will be breached first, in a way that leaks everything.

But also I think you're being naïve if you think security(-adjacent) people don't understand that people often prefer convenience.

The entire concept of a password manager is about convenience. Why do you think most mobile devices default to asking for a PIN code rather than a password? Why do you think credit/debit cards use a PIN rather than a complex password?

Convenience. It's literally all to make things more convenient.

I migrated from Google Authenticator before it offered backups too precisely for the backups/restoration.

The seemingly unnecessary depreciation of a tool we all use gives of dangerous vibes for the future.

It is not that I think that the Authy mobile app is going away, but rather that the design and features of it will slowly become worse over time. History backs me up on this.

And honestly, for something as fundamental as 2FA we should be using self hosted and open source tools without any corporate ties anyways.

This was just the push I needed to make that happen (Aegis).

https://support.authy.com/hc/en-us

My experience witnessing the regression and functional decline of this app over the years has utterly wrecked my opinion of Twilio. Although I still have a couple of operational Twilio integrations, I no longer have any desire to use any of their products or services ever again.

I liked the peace of mind of having it in the cloud so I don't randomly lose all of my accounts if I decide to replace my phone

This is extremely disappointing, I don't trust many other companies and this is a baffling decisio

I ran both side by side to log into the iOS version after downloading it on my MacBook.

Login was easy and everything came over. Just had to turn on multi-device, log in on the new app, then turn it off again.

Most of my TOTP is in 1Password, but for apps the require Authy integration the iOS version seems fine.

Instead of trying to extract the settings out of Authy, I simply visited each of the sites for which I have 2FA turned on, logged in with the Authy code (for the last time), went to the account config/profile section of the web page and chose "Setup new authenticator" (or similar). Then it shows you a new QR code. At this moment on your iPhone you switch to the Passwords app which is under Settings->Passwords and search for the website or enter a new record. Then click on "Set Up Verification Code", and choose the option to scan the QR code. That's all there's to it. From then on you can log in either from your iPhone or Mac, and doing the fingerprint/FaceId will enter the TOTP code.

Tip: After making the change on each website, open an incognito/private browsing window and log in again. That way old cookies can't mess things up. I found one site where the re-doing of the 2FA hadn't worked properly this way.