Comment on Authy got hacked, and 33 million user phone numbers were stolen
ugjka@lemmy.world 4 months ago
I realized long time ago that I don’t want my 2FA be tied to my phone number. And then i found you can’t export your data from Authy because they know they are scummy fucks and don’t want to anyone to leave
then i found you can’t export your data from Authy
Exporting data from a 2FA app sounds like the opposite of secure. Not to mention you don’t want your 2FA codes on Authy (or any other 2FA app) to remain valid if you’re not using it.
When I switched from Google Authenticator to Authy years ago, I went through each 2FA-enabled account one by one to disable 2FA and then re-enable it using Authy. It’s a long process depending on how many accounts you have 2FA enabled on, but it’s worth it.
If you can’t export / save / transfer codes then you need to regenerate all your 2fa codes every time you switch to a new device.
2FA doesn’t need to be infallible, it just needs to be a second factor.
So what did you do?
On Android, I replaced Authy with open-source Aegis app. It’s just as functional, allows exporting, and doesn’t tie your data to your phone number (or store it on a central system–not sure if Authy does this or not).
Use TOTP wherever possible. It’s standardized, and typically can be found somewhere if you keep digging hard enough.
Plenty of services push their own proprietary systems hard though. Looking at you M$
I also find this infuriating. I had a service offer TOTP for authentication. Installed an open source TOTP Aap, scanned the QR and voila.
The service meanwhile can control whether they want to generate a new token or give out the old one again, for instance when a device was lost.
It is the most easy, most convenient solution both for the service provider and the client. There is no excuse for any other 2FA system to be used.
I used This method to export my twitch 2FA to Aegis. although I did this a few years ago, I think it still works
Wow, that was one of the things that drew it to me in the first place. I break phones too frequently to feel comfortable leaving everything to them.
maryjayjay@lemmy.world 4 months ago
You can, though. But not through their app. Someone reverse engineered their protocol and wrote a program that connects like a new client, which you then approve, and it dumps all your random seeds into a text file. I then put them all into Keepass.
todd_bonzalez@lemm.ee 4 months ago
People keep acting like Authy is betraying them by not having an export feature, but why exactly are you leaving Authy to begin with? Because they are a security risk?
You’re gonna leave Authy a copy of your seeds? That defeats the purpose.
Re-key your MFA codes on the way out. Security isn’t necessarily convenient.
___@lemm.ee 4 months ago
Remind me to start a batch rekeying service.
todd_bonzalez@lemm.ee 4 months ago
I can’t even begin to stress what a terrible idea that is. You absolutely don’t want to make bulk-rekeying possible unless you like getting all of your accounts compromised at once.
maryjayjay@lemmy.world 4 months ago
They got rid of the desktop app.
Also, with shouldn’t have your seeds. They’re encrypted before they are transmitted to their servers and only decrypted on the device.
aliceblossom@lemmy.world 4 months ago
Do you know what it’s called? I’d like to do this if possible.
AngryCommieKender@lemmy.world 4 months ago
They added a link, but the project has been deprecated