#authy — Public Fediverse posts

#GDPR works

github.com/serbbil/Authy-GDPR-…

#authy

OTP Clients servers closed source & vendor lock-in

TIL about freeOTP an Open Source OTP client for the two major mobile OS.

I already have a couple of nice OTP clients on my phones and love to have alternatives, in case one is not compiled anymore for newer Android OS

History

Many years ago I stubled upon authy a closed variable OTP client for Android. It ran on Linux win64 Android

This pesky client did something you'd expect from an ex-girl / boy-friend!

Authy has a model where it allows you to seamlessly sync your OTP parameters with their double blind server network Double blind just like private bin, a magnificient piece of encryption software you should also know / learn about.
The authy sync network never sees your data since there are multiple encryption layers.

Without checking the fine print (just like your ex- there is none) I used authy, migrating my multitude of OTP records because I loved the convenience of auto server sync. THe migration took a redacted time (many OTP records reside here) and I added a redacted ammount of records afterwards...

Horrors krept up when I wanted to see my OTP records from within authy, not the output the codes themselves
I could not find that option, which my other OTP client has.
I send a tweet to authy verified account which I had frequent daily & fun conversations with, promoting the program on twitter (many many years ago).
I asked which external switch I could use in the linux client to export my OTP codes

Authy twitter: dead silence...

On my tweets I normally got responses within 5 - 30 minutes

I never got a response from them again

Baffled at this sudden chance in character (just like your ex- who ignores you in your own house all of a sudden) I did extensive research in the subject matter

Research had showed that authy has malicious code & policy which punishes people who use external methods to extract their OTP codes from the program!

What do they do you ask?

Simple:

• you are locked in using the program
• you get locked out trying to break the lock-in

Details

The OTP records are in encrypted vault(s) on your device, which could be your linux machine Android or mac / iphone
In order to get a OTP record decrypted contact was needed with the authy sync server network

You get cut off when they detect your attempt of jailbreaking your own OTP records

Your client is not allowed to contact the servers for a set ammount of time, locking you out of accessing all your accounts which you got trapped in the authy jail, just like your failed relationship with your ex-

When contact is allowed again, you will usually stop messing with your main account, leaving you only to create new OTP records for your accounts, defeating the convenience of server sided sync.

Authy you bad bad ex-!

I had forgotten the main rule

There is no cloud, just someone else computer!

After that debacle I fetched Open and ad free Android clients, of which none have Linux programs. These clients give full export posibilities and backup

Update:

I am looking now for Linux clients and executed

• apt install otp
• apt install otpclient

Otpclient gave me a warning that my OS memlocklimit is too low, which means I need to tune that first to sane levels. otherwise insecure memory use may be the result for otpclient.
I shall execute what is written in the last source link
I have now linux native OTP programs in which I can import my OTP data on my Android devices

This is where freeOTP shall also participate

Sources:

mnn otp(1)

man otpclient(1)

https://en.wikipedia.org/wiki/One-time_password

https://en.wikipedia.org/wiki/Multi-factor_authentication

https://en.wikipedia.org/wiki/OTPW

https://en.wikipedia.org/wiki/FreeOTP

https://freeotp.github.io/

https://www.freeipa.org/

https://github.com/paolostivanin/OTPClient/wiki/Secure-Memory-Limitations

#2FA #MFA #OTP #programming #Linux #Android #authy #bad #One #Time #Password #export

@jtb : an increasing number of people I know do no longer use desktops (that is, at home). An iPhone and an iPad, or an Android phone (and optionally a Chromebook), suffice for most people.

Commercial password managers will try to lock you in as a customer, while using open source (such as KeePass compatible) apps leads to other risks (such as stopped maintenance or malicious take over).

Most people I know even refuse to use password managers because of their complexity - while they enormously underestimate their risks by using one or a few weak passwords written on paper or stored in excel sheets.

Some of them feel betrayed after being advised to use TOTP 2FA - which is not phishing resistant, effectively *is* a password manager, too often without backups (of the shared secrets) being made, leading to account lockout after losing their phones (or app malfunction). And I'm not even considering privacy invasive and insecure TOTP apps such as Authy.

Nobody warned them of risks associated with TOTP, as nobody warns them for the risks that come with passkeys. People are, IMO, righfully not interested in the crap the industry is trying to enforce on them.

@rmondello @brandonbutler

#Passkeys #AccountLockout #Authentication #TOTP #Authy

Mein neues Handy ist ein #fairphone 6
Noch nie so ein teures Handy gekauft.
Aber wenn es doppelt so lange hält, amortisiert es sich vielleicht?
#Degoogling ist dann der nächste Schritt, aber im Moment geht's einfach noch nicht ohne ...
Ich versuche es mit "plus1".
Aber erstmal muss ich alle Apps neu einrichten/anmelden/umziehen.
Leider zickt ausgerechnet #Authy herum. Auf dem alten Gerät geht es nich, auf dem neuen sind alle Konten gesperrt und das Passwort (aus dem PW Manager) geht nicht...

Ente completes CERN sponsored audit

This includes (especially so) Ente Auth.

I wanted to bring some awareness to this because when I think of MFA I typically think of TOTP Authenticators. Like my friend Eric Hameleers (alienbob), I bent the knee way back and adopted the proprietary, closed source product Authy by Twilio.

Why? Because there were considerations to raise, such as, "What if I drop my phone in the fricken' toilet?", or, "I want my authenticator to support installs on multiple platforms and sync" - Actually, both of those considerations are really the same thing. The mess about this really was that Google Authenticator and others didn't sync, existed on a single device, and I had no need or desire to enjoy passwordless authentication offered by Microsoft for some resources.

Authy provided multi-devices w/sync, on #Android, #Linux, and #Windows, okay I guess, and my phone(s). And then Ente Auth came out, they were working on the desktop version and close to a release, it sync'ed with multiple devices and second best of all, it was the first truly cross-platform (Okay I never tried running it on a BSD) authenticator - it could sync between a Linux box and a Windows desktop and an Android - that's everything in my Universe, and actually, who cares about Windows anyway?

Just about that time, as I started considering the move, Twilio informed everyone that Authy support on Desktop was going Bye Bye!

So the choice at that point was Easy Peasy - migrate nowwwww!!! And so I fired up my rarely used wYnd0z3 box and got an alert - "This desktop version will be retired soon, you need to update to the lastest version as soon as possible"... in so many words.

Hmmm... Yeah, I dunno. I think I'mma do some online searches, this sounds fishy to me. And oh boy did it stink to high heaven. I'm glad I checked that out and found a little blurb (over on Reddit, IIRC) that covered the steps required to export everything, a script, a hacked up patch, and voila! done - got it!

There was one caveat there, for those who ventured into those same murky waters that I had - DO NOT APPLY THE TWILIO UPDATE!!!* For those who did, they found out quickly that the a patch no longer worked, they could not perform the export, and this was by design since the export had to be performed on a desktop version of Authy, effectively subjugating the non-daring with the typical enshittification that we've always known as #Vendor_Lockin.

By the time Eric apparently got around to making the move to #Ente_Auth from #Authy, the laborious process was entirely manual - one site at a time, which you can READ ABOUT HERE.

You really gotta watch these sneaky proprietary types of folks.

So anyway, fast forward a bit to where we are now, and although I mentioned my second fav reason to select Ente Auth, I didn't disclose my fav - which should be obvious: It's #FOSS. And not just that, but #Self_Hosted FOSS, if you prefer to keep things close to your breast.

Anyway, that's the backstory and the long way around my announcement here that you an read up on the Audit of all Ente products here:

https://ente.io/blog/cern-audit/

So, IMNSHO, There's really no reason to choose another authenticator, really, truly, there just isn't.

I hope that helps. Enjoy!

#tallship #redundancy #TOTP

⛵

.

🔐 What’s the best 2FA app in 2025? We break down Proton Pass, Aegis, and Authy—from encryption to device sync to backup ethics.

📱 If you’re serious about account security, this one’s for you.

📖 Read the full breakdown:
https://medium.com/@biytelum/the-ultimate-2fa-app-battle-proton-aegis-and-authy-duke-it-out-in-2025-2c0e6e1b4fa0

#2FA #CyberSecurity #DigitalPrivacy #Proton #Authy #Aegis #FOSS #infosec

How to Add Two-Factor Authentication (2FA) to WordPress in About 2 Minutes https://lowendbox.com/blog/how-to-add-two-factor-authentication-2fa-to-wordpress-in-about-2-minutes/ #twofactorauthentication #googleauthenticator #Tutorials #wordpress #Security #authy #2FA

2FA für #Nextcloud auf #Hetzner einrichten …

App #Authy angeworfen … QR-Code scannen …

Meldung: Format not supportet 😲

Was ein Dreck!
Bisher ging ja alles mit der App, auch bei Hetzner.
Muss ich jetzt WebAuth-Apps für #Nextcloud testen?

Ich tendiere dazu, mir eine tragbare, verschlüsselte Wolke einzurichten.
☝️🤓

@willsilvah Dica pra você. Use #enteauth
Utilizo a tempos depois que #Authy descontinuou client desktop.
Sim, ele tem client para desktop.

Fuck #Authy. Fuck it in it's stupid ass. They got rid of the desktop version. Fine. It sucks, but I could deal with it. Then they dropped support for #GrapheneOS. Meaning I'm locked out of everything. Luckily I have a #YubiKey so I can get into most things. I guess it's time to move to something else.

Als #authy den Export nicht mehr unterstützte, war es natürlich mühsam, die Daten alle umzuziehen.

Ich hatte mir eine Liste gemacht und dann nach und nach alle Dienste auf #enteAuth umgezogen (#2FAS wäre die zweite Option gewesen).

Genau so werde ich das nun mit allen meinen benutzten US-Diensten machen: in einer Liste alle Abhängigkeiten sammeln und dann nach und nach umziehen.

#esIstAnDerZeit #unplugTrump

I can't remember if I had mentioned this before, but apparently #Authy stopped enabling their iPad app from working on macOS.

Now, the app is forcing an update and I can't update it through the App Store.

What the fuck is actually going on?

Why take this feature away?!

Ugh, Authy just bricked their Catalyst app on macOS. I should have migrated long ago, but having almost 100 TOTP keys, so there is serious lock-in. 🤦‍♂️

#Authy #macOS #facepalm

Thanks everyone for all the recommendations! The reason I wanted to stop using Authy was because they were breached last year and they're also closed-source.

If someone is thinking of moving away from Authy the following seem to be the most-liked on Fedi, going by the replies: Ente, Aegis, FreeOTP+ and 2FAS. All of them are free and open source.

I chose Ente because it also works cross-platform. #Authy #AuthenticatorApp

I want to move away from Authy. Dear Fedi, safest authenticator app? Go. #AskFedi #Authy #AuthenticatorApp

Edit: I ended up going with Ente 🦆 https://ente.io/auth/

Moving all my #2FA keys away from #Authy was not the nightmare that I thought it would be: only about an hour of work.

Not only did I miss having a desktop app, but I had forgotten my Authy password and was down to 1 logged in device.

I've been trying to use more #OpenSource software in the new year, in the past two weeks I’ve made the switch for the following apps: (I’m on #macOS )

1. #1Password → #Bitwarden ( @bitwarden )
2. #Authy → #Ente Auth
3. #Ivory → Ice Cubes ( @IceCubesApp )
4. #AppCleaner → #Pearcleaner
5. The Unarchiver → #Keka
6. #Bartender → #Dozer
7. Caffeine → #KeepingYouAwake

There's a lot more to go, but I’m trying to go slow and enjoy the #FOSS journey.

Nachdem sich #Authy vor einigen Monaten als #2fa App disqualifiziert hat, suche ich jetzt endlich nach einer Alternative.

Empfehlungen?
Voraussetzungen: iOS, macOS, Android

(Ich liebäugle mit #Ente.)

Moving my 2FA Codes from Authy to Aegis
Author: Ben Tasker

https://www.bentasker.co.uk/posts/blog/general/switching-to-aegis-for-totp-codes.html?utm_source=rss

#2fa #aegis #authentication #authy #open-source #software #totp

New #blog post: Moving my #TOTP tokens from #Authy to #Aegis

In 2020, I moved my #2fa tokens from Google Authenticator to Authy. Unfortunately, Twilio have since changed things, undermining the reason that I'd chosen Authy in the first place.

I wanted the replacement to be #FOSS and after a bit of searching around, settled on Aegis Authenticator.

This post talks about why/how and what the benefits so far are.

https://www.bentasker.co.uk/posts/blog/general/switching-to-aegis-for-totp-codes.html

@cellio The #Authy redesign is a UX dumpster fire. It's stupidly difficult to find site codes visually now. I need to switch to something else but I'm in the middle of some other tech migrations and haven't ripped the band-aid off yet.

Some alternatives I've been looking into (open source):
https://ente.io/auth/
https://2fas.com/
There's other options too.

Authy : la version iOS ne peut plus être téléchargée sur les Mac Apple Silicon http://dlvr.it/TGFVWG #Authy #Mac

Lo siento #Authy, hoy dejaste de ser confiable. Afortunadamente, encontré tu sustituto y ya migré todas mis cuentas. No permitiré que vuelvas a ocasionar el desastre que hoy generaste al trabar mi #iPad de una manera que jamás había visto. Ya tenías rato portándote mal, al no validar mi PIN o quedarte trabado. No te recomendaré más.

#ios #2FA