#authy — Public Fediverse posts

Getting my TOTP data out of Twilio's Authy app thanks to the GDPR: https://blog.tomayac.com/2026/10/17/getting-my-totp-data-out-of-twilios-authy-app-thanks-to-the-gdpr/. New blog post in which I document how I used the sledgehammer 🔨 that is #GDPR to get my #TOTP #2FA 🔐 data out of #Authy and built myself a TOTP Vault PWA.

Goodbye Authy.

#authy #privacy #security #2fa #mfa

#GDPR works

github.com/serbbil/Authy-GDPR-…

#authy

OTP Clients servers closed source & vendor lock-in

TIL about freeOTP an Open Source OTP client for the two major mobile OS.

I already have a couple of nice OTP clients on my phones and love to have alternatives, in case one is not compiled anymore for newer Android OS

History

Many years ago I stubled upon authy a closed variable OTP client for Android. It ran on Linux win64 Android

This pesky client did something you'd expect from an ex-girl / boy-friend!

Authy has a model where it allows you to seamlessly sync your OTP parameters with their double blind server network Double blind just like private bin, a magnificient piece of encryption software you should also know / learn about.
The authy sync network never sees your data since there are multiple encryption layers.

Without checking the fine print (just like your ex- there is none) I used authy, migrating my multitude of OTP records because I loved the convenience of auto server sync. THe migration took a redacted time (many OTP records reside here) and I added a redacted ammount of records afterwards...

Horrors krept up when I wanted to see my OTP records from within authy, not the output the codes themselves
I could not find that option, which my other OTP client has.
I send a tweet to authy verified account which I had frequent daily & fun conversations with, promoting the program on twitter (many many years ago).
I asked which external switch I could use in the linux client to export my OTP codes

Authy twitter: dead silence...

On my tweets I normally got responses within 5 - 30 minutes

I never got a response from them again

Baffled at this sudden chance in character (just like your ex- who ignores you in your own house all of a sudden) I did extensive research in the subject matter

Research had showed that authy has malicious code & policy which punishes people who use external methods to extract their OTP codes from the program!

What do they do you ask?

Simple:

• you are locked in using the program
• you get locked out trying to break the lock-in

Details

The OTP records are in encrypted vault(s) on your device, which could be your linux machine Android or mac / iphone
In order to get a OTP record decrypted contact was needed with the authy sync server network

You get cut off when they detect your attempt of jailbreaking your own OTP records

Your client is not allowed to contact the servers for a set ammount of time, locking you out of accessing all your accounts which you got trapped in the authy jail, just like your failed relationship with your ex-

When contact is allowed again, you will usually stop messing with your main account, leaving you only to create new OTP records for your accounts, defeating the convenience of server sided sync.

Authy you bad bad ex-!

I had forgotten the main rule

There is no cloud, just someone else computer!

After that debacle I fetched Open and ad free Android clients, of which none have Linux programs. These clients give full export posibilities and backup

Update:

I am looking now for Linux clients and executed

• apt install otp
• apt install otpclient

Otpclient gave me a warning that my OS memlocklimit is too low, which means I need to tune that first to sane levels. otherwise insecure memory use may be the result for otpclient.
I shall execute what is written in the last source link
I have now linux native OTP programs in which I can import my OTP data on my Android devices

This is where freeOTP shall also participate

Sources:

mnn otp(1)

man otpclient(1)

https://en.wikipedia.org/wiki/One-time_password

https://en.wikipedia.org/wiki/Multi-factor_authentication

https://en.wikipedia.org/wiki/OTPW

https://en.wikipedia.org/wiki/FreeOTP

https://freeotp.github.io/

https://www.freeipa.org/

https://github.com/paolostivanin/OTPClient/wiki/Secure-Memory-Limitations

#2FA #MFA #OTP #programming #Linux #Android #authy #bad #One #Time #Password #export

@jtb : an increasing number of people I know do no longer use desktops (that is, at home). An iPhone and an iPad, or an Android phone (and optionally a Chromebook), suffice for most people.

Commercial password managers will try to lock you in as a customer, while using open source (such as KeePass compatible) apps leads to other risks (such as stopped maintenance or malicious take over).

Most people I know even refuse to use password managers because of their complexity - while they enormously underestimate their risks by using one or a few weak passwords written on paper or stored in excel sheets.

Some of them feel betrayed after being advised to use TOTP 2FA - which is not phishing resistant, effectively *is* a password manager, too often without backups (of the shared secrets) being made, leading to account lockout after losing their phones (or app malfunction). And I'm not even considering privacy invasive and insecure TOTP apps such as Authy.

Nobody warned them of risks associated with TOTP, as nobody warns them for the risks that come with passkeys. People are, IMO, righfully not interested in the crap the industry is trying to enforce on them.

@rmondello @brandonbutler

#Passkeys #AccountLockout #Authentication #TOTP #Authy

Mein neues Handy ist ein #fairphone 6
Noch nie so ein teures Handy gekauft.
Aber wenn es doppelt so lange hält, amortisiert es sich vielleicht?
#Degoogling ist dann der nächste Schritt, aber im Moment geht's einfach noch nicht ohne ...
Ich versuche es mit "plus1".
Aber erstmal muss ich alle Apps neu einrichten/anmelden/umziehen.
Leider zickt ausgerechnet #Authy herum. Auf dem alten Gerät geht es nich, auf dem neuen sind alle Konten gesperrt und das Passwort (aus dem PW Manager) geht nicht...

Ente completes CERN sponsored audit

This includes (especially so) Ente Auth.

I wanted to bring some awareness to this because when I think of MFA I typically think of TOTP Authenticators. Like my friend Eric Hameleers (alienbob), I bent the knee way back and adopted the proprietary, closed source product Authy by Twilio.

Why? Because there were considerations to raise, such as, "What if I drop my phone in the fricken' toilet?", or, "I want my authenticator to support installs on multiple platforms and sync" - Actually, both of those considerations are really the same thing. The mess about this really was that Google Authenticator and others didn't sync, existed on a single device, and I had no need or desire to enjoy passwordless authentication offered by Microsoft for some resources.

Authy provided multi-devices w/sync, on #Android, #Linux, and #Windows, okay I guess, and my phone(s). And then Ente Auth came out, they were working on the desktop version and close to a release, it sync'ed with multiple devices and second best of all, it was the first truly cross-platform (Okay I never tried running it on a BSD) authenticator - it could sync between a Linux box and a Windows desktop and an Android - that's everything in my Universe, and actually, who cares about Windows anyway?

Just about that time, as I started considering the move, Twilio informed everyone that Authy support on Desktop was going Bye Bye!

So the choice at that point was Easy Peasy - migrate nowwwww!!! And so I fired up my rarely used wYnd0z3 box and got an alert - "This desktop version will be retired soon, you need to update to the lastest version as soon as possible"... in so many words.

Hmmm... Yeah, I dunno. I think I'mma do some online searches, this sounds fishy to me. And oh boy did it stink to high heaven. I'm glad I checked that out and found a little blurb (over on Reddit, IIRC) that covered the steps required to export everything, a script, a hacked up patch, and voila! done - got it!

There was one caveat there, for those who ventured into those same murky waters that I had - DO NOT APPLY THE TWILIO UPDATE!!!* For those who did, they found out quickly that the a patch no longer worked, they could not perform the export, and this was by design since the export had to be performed on a desktop version of Authy, effectively subjugating the non-daring with the typical enshittification that we've always known as #Vendor_Lockin.

By the time Eric apparently got around to making the move to #Ente_Auth from #Authy, the laborious process was entirely manual - one site at a time, which you can READ ABOUT HERE.

You really gotta watch these sneaky proprietary types of folks.

So anyway, fast forward a bit to where we are now, and although I mentioned my second fav reason to select Ente Auth, I didn't disclose my fav - which should be obvious: It's #FOSS. And not just that, but #Self_Hosted FOSS, if you prefer to keep things close to your breast.

Anyway, that's the backstory and the long way around my announcement here that you an read up on the Audit of all Ente products here:

https://ente.io/blog/cern-audit/

So, IMNSHO, There's really no reason to choose another authenticator, really, truly, there just isn't.

I hope that helps. Enjoy!

#tallship #redundancy #TOTP

⛵

.

I suppose one way to try to prevent people from sandboxing their usage or placing their usage under "incognito" type browsers is to prevent users from updating their accounts' #security configurations/information if they don't use a given browser "frequently enough".

So, I'm in the process of switching my #TOTP based #2FA from #Authy to #EnteAuth. I'd originally adopted Authy because it had a synchronized desktop and mobile client. This meant that, when I was working some-place that didn't allow personal electronic devices — such as phones — so long as I could install Authy, I could still access my TOTP-protected accounts. Then #Twillio bought them and killed the desktop client.

Recently, a friend pointed me at EnteAuth. I've been slowly moving my TOTP-based 2FA from Authy to Ente.

I pretty much never login to #Facebook, any more (like, not since 2012). Basically, I login when it's the only means of communicating with someone I need to communicate with. Even then, I only ever use Facebook within a "private" browser session. Previously, when I'd wanted to convert my Facebook 2FA to Ente, it told me "you haven't been active enough for us to trust your changing of security settings" (password and/or 2FA options). "Fine. Whatever. Fuck it. I'll change it later," I figured. Revisited the site, this morning, and was again greeted with the "nope: not gonna let you do that" banner. And it occurred to me, "I'm never going to be able to change my credentials since I will never have a browser that I've used 'enough'."

My question, at this point, is, "do I bother trying to open and work through a support case to address this, do I just let the account continue to stale-out or, do I say 'fuck it' and just (finally) delete the account?" That said, I get the feeling that, were I try to delete the account, I'd get the same "we don't trust this browser" message.

"Funny" thing is, as noted previously, my Facebook account is 2FA-protected. And, it's not just by TOTP, it's also email-based PIN. So, when I login, not only am I presenting my username and password credntial-pair, I'm presenting a valid TOTP and email-delivered PIN. That should be more than enough to establish "the entity logging in to this account is who they say they are and we should allow them to update their account-settings". But, what do I know: I'm not a hyperscaler-qualified security "expert"

Still: never seems a good idea from impeding users from being able to keep their account-security configurations from going stale.

🔐 What’s the best 2FA app in 2025? We break down Proton Pass, Aegis, and Authy—from encryption to device sync to backup ethics.

📱 If you’re serious about account security, this one’s for you.

📖 Read the full breakdown:
https://medium.com/@biytelum/the-ultimate-2fa-app-battle-proton-aegis-and-authy-duke-it-out-in-2025-2c0e6e1b4fa0

#2FA #CyberSecurity #DigitalPrivacy #Proton #Authy #Aegis #FOSS #infosec

How to Add Two-Factor Authentication (2FA) to WordPress in About 2 Minutes https://lowendbox.com/blog/how-to-add-two-factor-authentication-2fa-to-wordpress-in-about-2-minutes/ #twofactorauthentication #googleauthenticator #Tutorials #wordpress #Security #authy #2FA

2FA für #Nextcloud auf #Hetzner einrichten …

App #Authy angeworfen … QR-Code scannen …

Meldung: Format not supportet 😲

Was ein Dreck!
Bisher ging ja alles mit der App, auch bei Hetzner.
Muss ich jetzt WebAuth-Apps für #Nextcloud testen?

Ich tendiere dazu, mir eine tragbare, verschlüsselte Wolke einzurichten.
☝️🤓

@willsilvah Dica pra você. Use #enteauth
Utilizo a tempos depois que #Authy descontinuou client desktop.
Sim, ele tem client para desktop.

After my issues with #authy, I've been looking for a replacement. #EnteAuth was a popular suggestion. I like it. It even works offline from my #QubesOS vault. I only wish I could list the codes in a grid on Android to save space.

Fuck #Authy. Fuck it in it's stupid ass. They got rid of the desktop version. Fine. It sucks, but I could deal with it. Then they dropped support for #GrapheneOS. Meaning I'm locked out of everything. Luckily I have a #YubiKey so I can get into most things. I guess it's time to move to something else.

Finally deleting my authy account. I stopped using it ages ago. I refreshed my 2FA tokens a way back and then I went though and removed them from Authy a minute ago. Now I'm doing the last step and just deleting my account. Now that that's done I gotta just delete all the apps.

#Authy #2FA #Security #AegisAuthenticator #Aegis

Als #authy den Export nicht mehr unterstützte, war es natürlich mühsam, die Daten alle umzuziehen.

Ich hatte mir eine Liste gemacht und dann nach und nach alle Dienste auf #enteAuth umgezogen (#2FAS wäre die zweite Option gewesen).

Genau so werde ich das nun mit allen meinen benutzten US-Diensten machen: in einer Liste alle Abhängigkeiten sammeln und dann nach und nach umziehen.

#esIstAnDerZeit #unplugTrump

Thar we go. Took the time and removed the rest of my 2FA codes from Authy. Gonna give it a week to clear out and then I'll probably just delete the account entirely.

Fun fact Authy used to have their own accounts and you apparently can't remove those once you set them up. I don't even know if the humble bundle or Twitch codes will even work but i know i can only "hide" them. Boo Twilo.. Boo.

Currently using: Aegis, KeePass, https://authenticator.cc/

#Twilo #Authy #2FA

Pues al final he cambiado #Authy por #2FAS para los códigos TOTP de los servicios. La empresa que lo desarrolla sigue siendo estadounidense pero el código es abierto y no se sube nada a sus servidores. Tienen la opción de guardar backup en iCloud en iOS o similar para Android si quieres. Y las cuentas son fácilmente exportables (e importables) al contrario que la caja negra de Authy. Más info en https://2fas.com/ con enlaces a su Github y a las sendas tiendas para su descarga.

#2FA

I can't remember if I had mentioned this before, but apparently #Authy stopped enabling their iPad app from working on macOS.

Now, the app is forcing an update and I can't update it through the App Store.

What the fuck is actually going on?

Why take this feature away?!

Ugh, Authy just bricked their Catalyst app on macOS. I should have migrated long ago, but having almost 100 TOTP keys, so there is serious lock-in. 🤦‍♂️

#Authy #macOS #facepalm

Thanks everyone for all the recommendations! The reason I wanted to stop using Authy was because they were breached last year and they're also closed-source.

If someone is thinking of moving away from Authy the following seem to be the most-liked on Fedi, going by the replies: Ente, Aegis, FreeOTP+ and 2FAS. All of them are free and open source.

I chose Ente because it also works cross-platform. #Authy #AuthenticatorApp

I want to move away from Authy. Dear Fedi, safest authenticator app? Go. #AskFedi #Authy #AuthenticatorApp

Edit: I ended up going with Ente 🦆 https://ente.io/auth/

Moving all my #2FA keys away from #Authy was not the nightmare that I thought it would be: only about an hour of work.

Not only did I miss having a desktop app, but I had forgotten my Authy password and was down to 1 logged in device.

I've been trying to use more #OpenSource software in the new year, in the past two weeks I’ve made the switch for the following apps: (I’m on #macOS )

1. #1Password → #Bitwarden ( @bitwarden )
2. #Authy → #Ente Auth
3. #Ivory → Ice Cubes ( @IceCubesApp )
4. #AppCleaner → #Pearcleaner
5. The Unarchiver → #Keka
6. #Bartender → #Dozer
7. Caffeine → #KeepingYouAwake

There's a lot more to go, but I’m trying to go slow and enjoy the #FOSS journey.

Nachdem sich #Authy vor einigen Monaten als #2fa App disqualifiziert hat, suche ich jetzt endlich nach einer Alternative.

Empfehlungen?
Voraussetzungen: iOS, macOS, Android

(Ich liebäugle mit #Ente.)

Moving my 2FA Codes from Authy to Aegis
Author: Ben Tasker

https://www.bentasker.co.uk/posts/blog/general/switching-to-aegis-for-totp-codes.html?utm_source=rss

#2fa #aegis #authentication #authy #open-source #software #totp

New #blog post: Moving my #TOTP tokens from #Authy to #Aegis

In 2020, I moved my #2fa tokens from Google Authenticator to Authy. Unfortunately, Twilio have since changed things, undermining the reason that I'd chosen Authy in the first place.

I wanted the replacement to be #FOSS and after a bit of searching around, settled on Aegis Authenticator.

This post talks about why/how and what the benefits so far are.

https://www.bentasker.co.uk/posts/blog/general/switching-to-aegis-for-totp-codes.html

@cellio The #Authy redesign is a UX dumpster fire. It's stupidly difficult to find site codes visually now. I need to switch to something else but I'm in the middle of some other tech migrations and haven't ripped the band-aid off yet.

Some alternatives I've been looking into (open source):
https://ente.io/auth/
https://2fas.com/
There's other options too.

Authy : la version iOS ne peut plus être téléchargée sur les Mac Apple Silicon http://dlvr.it/TGFVWG #Authy #Mac

Lo siento #Authy, hoy dejaste de ser confiable. Afortunadamente, encontré tu sustituto y ya migré todas mis cuentas. No permitiré que vuelvas a ocasionar el desastre que hoy generaste al trabar mi #iPad de una manera que jamás había visto. Ya tenías rato portándote mal, al no validar mi PIN o quedarte trabado. No te recomendaré más.

#ios #2FA

@neff Because I have a lot of 2FA codes in Authy, they all trigger when I've unlocked the app and I find too many visuals a bit overwhelming - especially as they're all on a countdown the moment I've unlocked it! It's a personal thing though, I'm not saying #Authy is bad as a solution.

I want to know I can hit "generate" then look at my monitor, with more than 10 seconds of my countdown left.

With that, and currently no darkmode, I'm switching. Personal preference though.

After a recent chat about #Authy and #2FA, I've now moved my #FFXIV security key to Aegis Authenticator.

No issues at all.

Just remember your emergency security key removal password may change so note that down somewhere safe if you switch key generator.

https://getaegis.app/

#Authy... let's have a chat

You discontinued Chrome Extension (fine)
Your parent company Twilio had a huge breach (okay, these things are so frequent in the industry I am almost desensitized)

But then you discontinued the desktop apps and the 🥤🐪🔙 you changed the mobile app UI and removed the Dark Mode toggle.

I'm not one to complain about app or site redesigns, but I'm not feeling #Authy's redesign.

MEN HVA I ALLE DAGER HAR AUTHY GJORT MED BRUKERGRENSESNITTET SITT???

Fra å være en ryddig og nøktern app for 2FA, har de tydeligvis ansatt en tenåring med overtenning til å utforme det nye designet. Dette er jo heeelt jævlig!! Blir jo sjøsjuk bare av å se på appen nå...

#authy #norsktut #allheimen

Die neue #Authy App hat es es geschafft mega unübersichtlich zu werden… 🙄 #DesignFail #2FA