Authy got hacked, and 33 million user phone numbers were stolen

Yeah. They got data in a way that was not intended. That's a hack. It's not always about subverting something by clickity-clacking like in the movies.

That's what most exploit-based hacks are. A developer makes a dumb mistake and then someone exploits it to do something they shouldn't be able to do.

This isn't about being pedantic but sure, mate.

I started using Authy instead of GA because every time I changed the ROM on my phone I would lose all codes, because I would forget every time.

Call my job and tell them this please. I have to use this shite everyday and it sucks.

I expect most usage of authy was based on the open TOTP protocol that Google etc use. The additional benefit was backing up those codes to the authy account, hence the avenue of attack on those accounts.

I agree though, Authy, especially since it was bought out, should be avoided. They deprecated their desktop app which was the only semi useful part of their suite, but I stopped using it years ago.

You know it's bad when people recommend something made by Google over it.

Wow, it's literally the shazam logo, flipped horizontally and red.

Wonder who got paid to make that logo?

You can, though. But not through their app. Someone reverse engineered their protocol and wrote a program that connects like a new client, which you then approve, and it dumps all your random seeds into a text file. I then put them all into Keepass.

Edit: Unfortunately, the author has deprecated the project as Authy has added some attestations to their API, seemingly for this exact issue. https://github.com/alexzorin/authy?tab=readme-ov-file

So what did you do?

then i found you can't export your data from Authy

Exporting data from a 2FA app sounds like the opposite of secure. Not to mention you don't want your 2FA codes on Authy (or any other 2FA app) to remain valid if you're not using it.

When I switched from Google Authenticator to Authy years ago, I went through each 2FA-enabled account one by one to disable 2FA and then re-enable it using Authy. It's a long process depending on how many accounts you have 2FA enabled on, but it's worth it.

Reading the OP, looks like it's time to generate new keys for all my 2FA accounts.

I used this method to export my twitch 2FA to Aegis. although I did this a few years ago, I think it still works

Edit: reading though comments made me realise Authy's desktop app doesnt seem to be a thing anymore, so sadly I dont think it works anymore

Bitwarden would be my vote

Aegis

These are not local solutions, but are cross-platform and open source: Bitwarden or Proton Pass.

I like 1Password's built in MFA support, if it's a really sensitive account I use Google Authenticator because I haven't bothered researching better local alternative

Edit: Going to try Aegis for the more sensitive logins, looks like what I'm looking for

Most decent password managers (e.g. 1Password, Proton Pass) have MFA built-in. Use those.

Most KeePass clones have it now, i use Keepass2Android plus KeePassX on PC

https://news.itsfoss.com/ente-auth/

I use this on my windows machines, offline , has biometrics, supports export and import from aegis. Is new and untested but past few months have been solid.

I'd recommend 2FAS Auth

I'm using aegis, but maybe Proton Pass could be good?

USB keys. Good luck getting one of those hacked.

Buy a few (at least 2 for a backup) yubikeys.

Much more secure.

You can store the TOPT codes on them, but then you can also do all the higher security things too.

No one's breaking into your Google account if you secure it with those keys and remove the sms backup method unless they've physically stolen the yubikey

KeePassXC does have this functionality on desktop as well as on SOME android apps (no idea for iOS). For android I like KeePass2Android Offline, iirc it was recommended on the official KeePassXC website (you may want to check it out).

Of course. It was on the office phone that gets passed around to whichever tech is on call. The on-call tech left it at Mcdonalds accidentally.

What do you use now?

I use Aegis, which I periodically back up manually off phone.

Bitwarden has 2FA built in, and you can host it yourself if you want.

Aegis is often recommended as an open source solution : https://github.com/beemdevelopment/Aegis

If you're talking about being able to regain access with no local backups (even just a USB key sewn into your clothing) your going to need to think carefully about the implications if someone else gets hold of your phone, or hijacks your number. Anything you can do to recover from the scenario is a way an attacker can gain access. Attempting to secure this via SMS is going to ne woefully insecure.

That being said, there are a couple of approaches you could consider. One option is to put an encrypted backup on an sftp server or similar and remember the login and passwords, another would be to have a trusted party, say a family member or very close friend, hold the emergency codes for access to your authentication account or backup site.

Storing a backup somewhere is a reasonable approach if you are careful about how you secure it and consider if it meets your threat model. The backup doesn't need to contain all your credentials, just enough to regain access to your actual password vault, so it doesn't need to be updated often, unless that access changes. I would suggest either an export from your authentication app, a copy of the emergency codes, or a text file with the relevant details. Encrypt this with gpg symmetric encryption so you don't have to worry about a key file, and use a long, complex, but reconstructable passphrase. By this I mean a passphrase you remember how to derive, rather than trying to remember a high entropy string directly, so something like the second letter of each word of a phrase that means something to you, a series of digits that are relevant to you, maybe the digits from your first friend's address or something similarly pseudo random, then another phrase. The result is long enough to have enough entropy to be secure, and you'll remember how to generate it more readily than remembering the phrase itself. It needs to be strong as once an adversary has a copy of the file they jave as long as they want to decrypt it. Once encrypted, upload it to a reliable storage location that you can access with just a username and password. Now you need to memorize the storage location, username, password and decryption passphrase generator, but you can recover even to a new phone.

The second option is to generate the emergency, or backup, codes to your authentication account, or the storage you sync it to, and have someone you trust keep them, only to be revealed if you contact them and they're sure it's you. To be more secure, split each code into two halves and have each held by a different person.

I have similar requirements to you and honestly the best solution I could find was Microsoft Authenticator. I know Microsoft bad etc, but if you already have a Microsoft account anyway you can back up all your 2fa codes to your iCloud or Google account. If anyone knows of an open source alternative I’d be interested, but the ability to recover my accounts is more important than using something open source

2FAS

Aegis. Make an encrypted backup. Store the backup safely. Done

Ente auth is new, but open and cross-plat, unlike aegis. Aegis still wins on Android but ente can import aegis encrypted backups.

I highly recommend 1Password. It's cross platform, including Linux, and it's not only a great and sort l super secure password manager, but it also does 2FA codes and if you use their auto fill tool, it will also paste the 2FA code to clipboard so you can paste it in seamlessly.

Everything is full encrypted and needs a really long, unique to you, key to decrypt. So no one will be hacking this anytime soon. Even 1Password cannot open your vault.

Like many others in this thread I love Aegis, I regularly back it up to my nas and it hasn't failed me yet, but I also selfhost Vaultwarden. Recently I've found myself copying a lot of my secrets over so if I don't have my phone, I still have a way to use TOTP.

I use Aegis

This is why I switched to Bitwarden, will probably move it to self hosted at some point as well

They wanted to let companies pay for a non standard 2fa code generation tied to the phone number as it was easier than the mainstream option that was the almost abandoned google authenticator that didn't allow backups.

Cloudflare, humble bundle used that scheme and I hated them for that. Seems that now that plan failed and essentially now authy is a money-losing operation for twilio and this shows on the unsecured API access that allowed the hack

The problem is so many services requiring SMS to be that second factor. From what I've heard it's easy enough to steal a sim that if you're being explicitly targeted it's basically the same as no second factor. Yet even if using an authenticator app most services require you to still have SMS/phone as another option for the 2FA.

For Authy specifically they'd need to guess your master password and then hijack your phone number, and for users of Authy I suspect their passwords are not easily guessed as it's already a step above the standard SMS only 2FA most services require.

"What if I lose my phone?"

I've referenced this scenario in a comment elsewhere in the thread. You've missed the problem in your solution.

A backup is useless if I can't access it when I need to. In the scenario where I'm far from home and have only got a replacement phone to work with, I need a way to access my OTP database (with only my phone number as a 2nd factor, thanks to ESIM provisioning) so I can get to my cloud storage for my password database.

This is a real scenario that doesn't seem covered by most options and people seem to keep glossing over it (And before anyone says that's not likely, I've been in that exact scenario before)

My passwords are safe.

No, they're really not. No matter how good your password is, it can absolutely be compromised. If you use a password manager, just look at how often sites tell you that you "forgot" your password, despite knowing you haven't.

Use 2fa for things that are absolutely vital. Whether you use it for your Blizzard account or Steam account is less important. (Though I'm pretty sure Blizzard has leaked passwords at least once, many years ago.)

I hate 2FA tied to a phone number. It makes it really hard to change your phone number when you’ve got 150 random accounts tied to it. Let me put that TOTP in my password manager.