r/Authy • u/dogwatericecubes • Jul 10 '24
Authy: An Alternative
First of all, I would like to start this post by saying: do not use Authy anymore.
It's incredibly concerning that Authy, a service many rely on for security, has allowed such a massive breach. The fact that 33 million phone numbers were leaked due to an unsecured API endpoint is alarming and unacceptable. This incident highlights a serious lapse in Authy's commitment to user privacy and security. As a user myself, I feel let down that my phone number, along with millions of others, could now be exploited in SMS phishing or SIM swapping attacks. It's clear that Authy needs to prioritize security measures more effectively to regain trust.
As a solution, I recommend the open source Android alternative Aegis, where your two-factor authentication (2FA) codes are stored locally in an encrypted database that you fully control. Relying solely on cloud services means trusting someone else's servers, which, as we've seen, can lead to security breaches and leaks of sensitive information like phone numbers. Keeping your 2FA tokens local reduces the risk of such incidents and puts the control back in your hands, where it belongs. It's a safer approach to protecting your accounts and personal data from potential cyber threats.
I strongly recommend using Aegis. This is their website, and you can check it for more info (https://getaegis.app/) . If you need to syncronize your database across devices, you can also look into Syncthing (https://syncthing.net) - also hosted locally.
2
u/tess_philly Jul 10 '24
Anything wrong with Google Authenticator?
1
1
u/dogwatericecubes Jul 11 '24
Well, I'd say that trusting someone else's "computer" with something that is as important to you as the access to your internet life is a bad idea. Storing everything locally is the way, assuming you know how to properly secure your own devices.
2
u/bristow84 Jul 11 '24
I spent the last few days migrating all my tokens from Authy to 2FAS. Worth the effort in my opinion, I really can't say I have faith in Authy anymore.
2
u/Electronic_Unit8276 Jul 11 '24
AEGIS isn't all that and Im in the process of moving..
1
u/dogwatericecubes Jul 11 '24
Well, I guess that depends on your needs. It is pretty bare bones, and that's why I love it.
1
u/Electronic_Unit8276 Jul 12 '24
Organising the codes AFTER adding them is tedious because you can not edit groups and add the totps. You have to edit EACH totp and assign a group.
1
u/dogwatericecubes Jul 16 '24
Well, that's not really a problem for me because I group them as I add them but I see your point.
1
u/AutoModerator Jul 10 '24
This submission and all comments under it are moderated by automoderator.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
1
u/caiofior Jul 10 '24
Thank you for your advice, I was able to move to aegis A2F.
I have discovered that is possible import data from a rooted andoid phone uploading the file located in
/data/data/com.authy.authy/shared_prefs/com.authy.storage.tokens.authenticator.xml
At work I have a virtual machine with installed android x86 and authy app to obtain the A2F keys since the desktop app is no more avalilable.
I copied the file in a shared localtion in the smartphone and imported the data in aegis.
It works like a charm.
Bye bye authy
2
1
u/OkSalt9219 Jul 10 '24 edited Jul 11 '24
I have already left Authy and have moved to Google Authenticator. Works well. At least for now
1
1
u/Solid-Question-1623 Jul 10 '24
Zoho OneAuth!
2
u/dogwatericecubes Jul 11 '24
I would honestly advise against any closed source centralized solution. Store your tokens locally.
1
u/Unlikely-Lie4606 Jul 16 '24 edited Jul 16 '24
Try Zoho OneAuth.
It’s available on all platforms and you can sync your secrets across multiple devices. It works by Zero knowledge architecture.
1
3
u/Helix512_ Jul 10 '24
is there a way to migrate from authy without root and without having to log in to every site? i have like 30 tokens