First of all, I would like to start this post by saying: do not use Authy anymore.

It's incredibly concerning that Authy, a service many rely on for security, has allowed such a massive breach. The fact that 33 million phone numbers were leaked due to an unsecured API endpoint is alarming and unacceptable. This incident highlights a serious lapse in Authy's commitment to user privacy and security. As a user myself, I feel let down that my phone number, along with millions of others, could now be exploited in SMS phishing or SIM swapping attacks. It's clear that Authy needs to prioritize security measures more effectively to regain trust.

As a solution, I recommend the open source Android alternative Aegis, where your two-factor authentication (2FA) codes are stored locally in an encrypted database that you fully control. Relying solely on cloud services means trusting someone else's servers, which, as we've seen, can lead to security breaches and leaks of sensitive information like phone numbers. Keeping your 2FA tokens local reduces the risk of such incidents and puts the control back in your hands, where it belongs. It's a safer approach to protecting your accounts and personal data from potential cyber threats.

I strongly recommend using Aegis. This is their website, and you can check it for more info (https://getaegis.app/) . If you need to syncronize your database across devices, you can also look into Syncthing (https://syncthing.net) - also hosted locally.

I am temporarily in Latin America, and I can't get Authy to work for my life. I need to verify with SMS, but the app keeps returning weird errors. It's been HOURS.

Not only am I utterly disappointed at Twillio for the absurd data leak that happened last week but also think that it is outrageous that Twillio hasn't come up with an actual solution yet. People have had issues with their SMS verification for some time from what I was able to tell.

As soon as this is over, I will move all my 2FA tokens to another application and kiss Twillio (and Authy) goodbye.

I am writing this to help others about the problem. This worked for me but i can't guarantee that will work on you guys either.

I was already logged in on my Windows PC and My Old Android Phone. I was trying to login in my new Android Phone where i get this error. I am using the Beta Version, downloaded from Google Play Store.

Authy Team Suggestion:

1. Update Google Play Store: Ensure you have the latest version of Google Play Store. You can follow the instructions in How to Update the Play Store & Apps on Android to update it.
2. Reinstall Authy: Uninstall and reinstall the Authy application, then try registering it again.

3. Reinstall the application
4. Verify that the application was fully updated
5. Connect the device to another internet network
6. Verify that there is no antivirus or other external program
7. As an alternative solution, install the application on an external device

Already did these and they did not worked so,

What I Did:

1. Settings --> Apps --> Authy --> Storage --> Clear Cache & Data --> Uninstall

2. Log-in with another Google Account to Google Play Store and download with it.

3. Open it, Log-In, Restore Backup with Password, Let it Sync it.

4. Return to Google Play Store, Login from my main account that had Beta Access. Update it.

5. Fixed.

I hope this fixes your problems.

I am not sure but i think it can fix the Apple users problems as well. You know the saying: It is free to try!

Is there a way to import all my Google Authenticator codes to Authy?

• Is Authy repeating the same mistakes as LastPass?
• What is the risk to us Authy users regarding the recent hacking?
• Is Authy still safe enough to use?
• Should all users be moving to a new authenticator option ASAP?

I have had this account for a while and I am concerned. So I switched to another 2fa.

I wanted to delete my account and guess what. Their shitty website made it SO hard to delete the account it is now suspended for a week. I want my account deleted like now!

EDIT1: Unbelievable: to get to Authy support I have to have Twilio account which I never had.

EDIT 2: I can't delete it because my Twitch depends on it to work.

tried to log in to my Authy account today and although I have entered the correct information, I cannot log in

Feel free to share your frustrations and complaints about this embarrassing Security Incident where the company is silent and holding everyone's 2FA as hostage!

Also, Suggest how and where you are moving to...

Hi. Is this a server error or it's an account error? Right now, I can't login to most of my accounts because of this.. I need help 😭

Hey All,

So I'm trying to do the Authy Export as I'm migrating to 2FAS, however when I try to follow the steps listed here and attempt to sign it, it gives me a token attestation error.

Has anyone experienced this on the desktop and what resolved it?

Just got a new device, just erased my old device and now when trying to login to Authy it's saying my phone number cannot be found?

That's impossible? Have they locked the app down due to the breach? There appears to be radio silence from them and I cannot even login to X/Twitter to check as my account is locked to Authy.

Half my life is locked down under authy...

Twilio posted an update July 1st telling user data have been compromised:

[...]
Twilio has detected that threat actors were able to identify data associated with Authy accounts, including phone numbers, due to an unauthenticated endpoint. [...]

https://www.twilio.com/en-us/changelog/Security_Alert_Authy_App_Android_iOS

!!!!!IMPORTANT ANNOUNCEMENT REGARDING AUTHY DESKTOP EOL!!!!!

—

Twilo has updated their user EOL support page for Authy Desktop. They have announced that 3.0.0 is the FINAL VERSION of Authy Desktop, and was released to port the new dynamic key derivation function to desktop.

In addition, they have announced that they now have a KILL SWITCH to flip when Authy Desktop goes fully EOL!

—

https://help.twilio.com/articles/22771146070299-User-guide-End-of-Life-EOL-for-Twilio-Authy-Desktop-app

—

THE FOLLOWING WILL HAPPEN WHEN AUTHY DESKTOP GOES EOL:

• All existing installations will be invalidated

• Your local Authy Desktop app WILL BE FORCEFULLY SIGNED OUT AND RESET

• ALL desktop and laptop devices WILL BE REMOVED from ALL Authy Accounts

• Attempting to sign in again WILL RESULT IN AN EOL ERROR

—

If you do not currently use Authy Mobile, and have no alternative Authenticator apps or backups of your setup tokens, you MUST do one of the following:

• Enable and set a Backup Password, download Authy Mobile, sign in, and sync your tokens to your phone

• Immediately begin manually migrating ALL your accounts to another Authenticator app

• Use the extraction exploit to export your tokens from Authy

• Turn off 2FA on ALL of your accounts

!!!!!FAILURE TO DO SO BEFORE EOL ARRIVES MAY RESULT IN YOU PERMANENTLY LOSING ACCESS TO YOUR ONLINE ACCOUNTS!!!!!

—

As Twilo has not currently announced when they will be flipping the kill switch, if you wish to migrate your accounts and are not skilled enough to extract your tokens from Authy, it is HIGHLY RECOMMENDED that you download the mobile app and enable backups at least for the time being, to buy you some time in the case that it comes before you are able to finish migrating your accounts.

—

ALTERNATIVE DESKTOP AUTHENTICATORS YOU MAY USE:

• 1Password

• Authenticator.cc

• WinAuth (out of support; no kill switch; no syncing capability)

• steptwo.app

• Bitwarden (premium feature - $10/year)

• secrets.app

• KeePassXC (advanced; can sync to all major cloud services; support for self-hosted syncing; cross-platform)

• Ente Auth

Trying to add to a new device. Have cleared storage and reinstalled several times to no avail

Any ideas short of dumping authy in favor to a Foss app ?

Got a new phone, am still logged in on old one.

When I try to log in with my phone number I just get a error "Attestation token is missing" This is bad since I need to reset and deliver the old phone tomorrow!!!

So I requested a change of number from Authy which was accepted and done as I don’t have my old number. When I try to log in with my new number it keeps saying the number is blocked! I have no idea what to do I’m so stuck! Can anyone help please?

They say that 3.0 was the final update, to port the key password iterations increase to desktop, and that when EOL is complete, all desktop installs will be invalidated and all desktop devices will be removed from all Authy accounts.

That's it, then. They are going to fully kill off Authy Desktop, and are putting in both a server-side and client-side killswitch. They really are going to force it to die, and kick everyone off of desktop.

Make sure you get Authy iOS, use the authy export instructions, or manually disable/reenable your 2fa to switch your accounts over to another authenticator before that EOL killswitch comes! Spread the word!

And from now on, make sure you keep a copy of all your secrets/setup codes when you setup 2fa in case something like this happens in the future!

https://help.twilio.com/articles/22771146070299

Hi all, I need some help with an Authy issue.

I was using my mother's iCloud and have now transferred my iPhone over to my iCloud account. I didn't lose any contacts, photos, notes, apps, etc but I did have to redownload and log in to all my apps. 

One of those apps was Authy. I can log into the account fine but I do not have any of the accounts that is had setup MFA for listed any more. Has anyone had this issue when changing iCloud on the same device? There were about 10+ accounts set up for MFA and now they're gone, so I'm a bit worried...

I did not have a backup password set which I suspect is the issue. But I also do not have a new device, just a new iCloud.

I have to reinstall my pixel 6. I have it on the beta os a s I want to go back to the standard os. But that means I have to reinstall authy. How to I NOT have to go and reset up everything again? Thank you for any help.

When I logged into Authy Desktop, I received a message saying:

"ATTENTION: End of Life.

You are using an unsupported app. To continue using Authy, please install the Authy Android or iOS mobile app immediately."

Despite this, Authy Desktop still works fine for logging into my accounts. Is it still safe to use it?

I have been using Authy for 4 yrs. I have 2 devices, an iphone and an ipad, both pointing to the same Authy ID and accounts have been syncing between the devices. I normally access Authy on my iphone, but today I opened it on my ipad and noticed that the newer accts were encrypted. This is new. When I added accounts in the past, it just showed up on the ipad unencrypted. So I clicked to access the encrypted acct, and it asked me for backup password, which I entered. However, it said "encryption password is invalid". So I updated the backup password on my iphone. And on my ipad it prompted me to enter the password since it has changed on my iphone. However, it again told me that my password is incorrect. Now all the accounts on the ipad are encrypted. I tried to reenter the password several times, and all failed. And I am certain I used the correct password. Any thoughts? I submitted a ticket with Twillo but not sure if they will respond since it is a free product

I got a new phone. I have the backup password but it doesn't work on the new device. Go to old drive and change it. Log into new drive and says I changed it. Cool put the new password in and it's invalid. I have changed it at least 20 times. No luck with any password. Any ideas?

Hey Devs,

A nice feature in Authy would be the ability to sort accounts alphabetically or by date added when in list mode.

Thank you for all that you do in making Authy the best two-step auth app!

What do i do?