Authy Is Sunsetting Its Desktop Authenticator Apps on March 19, 2024

[MacRumors]

Authy, the two-factor authentication (2FA) service, says its desktop apps for macOS, Windows, and Linux will reach end-of-life on March 19, 2024.

Twilio, the company that owns Authy, revealed the decision on Wednesday in a updated support article. It did not say whether Authy Desktop apps will stop working after this date or simply no longer receive updates, but the company confirmed that its mobile apps will continue to be maintained.

As one of only a few third-party desktop 2FA code generator apps on Mac, the loss of Authy Desktop is likely to disappoint users who got used to signing into 2FA-protected accounts from their computer rather than having to get out their phone, where most 2FA apps usually live.

For users in this position that own a Mac powered by Apple silicon, Authy suggests downloading the iOS version of the app to their computer. Otherwise, Authy recommends using the mobile version instead, or switching to a different authenticator app. The bad news is that anyone who wants to switch to another 2FA app entirely will have to disable 2FA on all of their stored accounts first, because Authy lacks an export feature.

• How to Use Safari's Built-in 2FA Code Generator

At the beginning of the year, Authy said that it was shutting down its desktop app in August 2024, so it has brought forward its decision to sunset the app by several months. The company said its decision to kill its desktop versions was made to "streamline our focus and provide more value on existing product solutions for which we see increasing demand."

Article Link: Authy Is Sunsetting Its Desktop Authenticator Apps on March 19, 2024

 

[OS X Dude]

1Password or iCloud Keychain ftw. We use 1Password at work purely for the flexibility of Shared Vaults.

 

[Torley]

I used Authy, but it was disappointing for awhile. You couldn't easily organize and archive accounts, so it ended up looking like a janky mess. Too much time was spent finagling things around.

More elegant solution — migrate to 1Password, which has a built-in authenticator. The autofill works really nicely on the whole. And it continues to have healthy multiplatform support, including macOS desktop. It's made security hygiene a lot more user-friendly.

1Password's overall flow is much more elegant than, say, LastPass and others. Especially with v8, they've really paid attention to scaling the storage of many passwords and other related secure data.

YES like @OS X Dude said, 1Password operationally makes it SUPER-SIMPLE to share, one-time or longer, even with those who don't have a 1Password account. Shared Vaults are great for families and businesses alike — just drag-and-drop and it's there!

 

[hacky]

I'm using Authy for quite a long time. Great thing! I did not know desktop app even existed. iOS app is all right and together with shared clipboard, it really not a big deal to open the app on my iPhone.

Also I don't think it's good security-wise to have both factors accessible from one device. Imagine virus getting into your macOS - your 2FA is useless now, because attacker got access to both factors at once.

Authy + Bitwarden. Best solution. It's free and it's cross-platform. You are not locked to single ecosystem and you can access your credentials from any major system you need. Oh and you can also selfhost Bitwarden if you are into that and want to take it step further, away from cloud.

 

[pesos]

OTP on a desktop that contains your passwords is not MFA.

 

[boss.king]

OTP on a desktop that contains your passwords is not MFA.

You know you can lock 2FA apps with their own password, right?

 

[pesos]

You know you can lock 2FA apps with their own password, right?

Of course you can. You know you haven't refuted what I said, right?

 

[Ryan.123]

Raycast on a Mac with the aughy plugin, way better anyway

 

[ahmoda]

I'm using iCloud keychain as a verification code generator app and it works perfectly and across all apple devices.

 

[rustygh]

I'm using Authy for quite a long time. Great thing! I did not know desktop app even existed. iOS app is all right and together with shared clipboard, it really not a big deal to open the app on my iPhone.

Also I don't think it's good security-wise to have both factors accessible from one device. Imagine virus getting into your macOS - your 2FA is useless now, because attacker got access to both factors at once.

Authy + Bitwarden. Best solution. It's free and it's cross-platform. You are not locked to single ecosystem and you can access your credentials from any major system you need. Oh and you can also selfhost Bitwarden if you are into that and want to take it step further, away from cloud.

Plus authy on my watch, I don't have to get out my phone. 😉

 

[scheinderrob]

I used Authy, but it was disappointing for awhile. You couldn't easily organize and archive accounts, so it ended up looking like a janky mess. Too much time was spent finagling things around.

More elegant solution — migrate to 1Password, which has a built-in authenticator. The autofill works really nicely on the whole. And it continues to have healthy multiplatform support, including macOS desktop. It's made security hygiene a lot more user-friendly.

1Password's overall flow is much more elegant than, say, LastPass and others. Especially with v8, they've really paid attention to scaling the storage of many passwords and other related secure data.

YES like @OS X Dude said, 1Password operationally makes it SUPER-SIMPLE to share, one-time or longer, even with those who don't have a 1Password account. Shared Vaults are great for families and businesses alike — just drag-and-drop and it's there!

i have 1pass, is there a way to migrate or do i have to remove/add 2fa into my accouts?

 

[bsolar]

It should be possible to export the keys from Authy without having to reset every account.

It's not exactly a straightforward process, but I did it successfully years ago. It requires accessing Desktop Authy through its debug port and exporting the raw data.

The GIST documentation.

A YouTube video guide.

Note: for my migration I did not generate the QR-Codes as described, I simply manually copy-pasted the security tokens from the raw data into my new 2fa tool.

 

[scheinderrob]

OTP on a desktop that contains your passwords is not MFA.

Of course you can. You know you haven't refuted what I said, right?

here comes the 'Ackchyually' crowd.

it's better than no 2FA at all.

 

[boss.king]

Of course you can. You know you haven't refuted what I said, right?

Alright, elaborate. How is multi-factor authentication not multi-factor authentication just because your 2FA app is accessible from a device that can also access your passwords?

 

[SpanishAppleNerd]

1Password or iCloud Keychain ftw. We use 1Password at work purely for the flexibility of Shared Vaults.

I used Dashlane until a few days ago, now a 1Password user too and when Twilio sent me the email I started ussing 1Password code generator too

 

[SpanishAppleNerd]

i have 1pass, is there a way to migrate or do i have to remove/add 2fa into my accouts?

Remove and add, did it two days ago and it ws relatively easy

 

[Joe Mac User]

I'm using iCloud keychain as a verification code generator app and it works perfectly and across all apple devices.

Yeah, and it offers to insert the code like it does with username and password already, no need to hurriedly copy and paste before the code expires (or wait for the next one). Also, no need to go through setting up Authy on any new devices since my account will bring over all usernames, passwords, and codes when I sign in to iCloud.

I’ve just migrated to this entirely and deleted Authy from my devices. I was willing to let go of the fact they were killing the Mac app, but the sudden announcement that they were moving up the date rubbed me the wrong way.

 

[HQuest]

iCloud offers 2FA natively on the Mac - or any Apple device really - and you can download it on Windows too. Options and alternatives are great but Authy has taken some Google Auth decisions lately, I guess all I can tell them is good riddance.

 

[Japan Ricardo]

Yeah, and it offers to insert the code like it does with username and password already, no need to hurriedly copy and paste before the code expires (or wait for the next one). Also, no need to go through setting up Authy on any new devices since my account will bring over all usernames, passwords, and codes when I sign in to iCloud.

I’ve just migrated to this entirely and deleted Authy from my devices. I was willing to let go of the fact they were killing the Mac app, but the sudden announcement that they were moving up the date rubbed me the wrong way.

Exactly. Keychain is all I need or use.

 

[NagasakiGG]

What do people always have their fetish with some 3rd Party MFAs and Password manager? Just use Apple's ones...

 

[mazz0]

Do they not provide a browser plugin? Why would you use a TOTP solution that requires manually grabbing a code from an external app when it can be build in to your browser?

 

[svish]

Expecting to see iOS app to remain for some more time. Otherwise iCloud Keychain should be more than enough.

 

[mazz0]

OTP on a desktop that contains your passwords is not MFA.

I can see what you're getting at, but I disagree. The authentication still requires multiple factors: you need the pre-authenticated desktop computer, and you need your password, or more likely your biometrics. That's a thing you have (the pre-authenticated desktop computer) and a thing you are/know (biometrics/password). That's textbook MFA.

 

[klasma]

Does they not provide a browser plugin? Why would you use a TOTP solution that requires manually grabbing a code from an external app when it can be build in to your browser?

The manual step is an additional factor. Conceivably a compromised browser could access your codes without you noticing.

 

[mazz0]

The manual step is an additional factor. Conceivably a compromised browser could access your codes without you noticing.

Maybe, but that's quite an added inconvenience to mitigate a very small risk. There'd have to be a major security flaw in your browser/plugin to enable it to decrypt your secrets without you authenticating.