Follow

Last week I had to spend hours resetting all the tokens I had in because they have elected to use the Play Integrity API to decide whether a device is safe, and that API marks devices using my mobile OS, , as unsafe, despite the fact that it is a *hardened* version of which is actually *more* secure. Aside from the inherent stupidity of this, it's just unacceptable for a 2FA solution to abruptly stop working; you are potentially leaving your users in a very tough position. As a result, I wouldn't touch Authy with a 10 foot pole in the future.

arstechnica.com/gadgets/2024/0

Luckily I found out before it stopped working on my device and was able to still use Authy long enough to login and create new tokens stored in a different authenticator. I previously thought I'd be protected from issues with a single devide, since Authy will sync your tokens to multiple devices, except they also had recently stopped supporting their desktop software (my second device). This also meant that I couldn't easily export the existing tokens and had to spend a bunch of time logging into each account to create new TOTP authentication tokens.

Note also that I didn't find this out from Authy (as I should have if they were doing their job); I found it out from discussion on Mastodon in this thread

grapheneos.social/@GrapheneOS/

Show thread

One saving grace here is that for really important things I use my Yubikey, FIDO2 (i.e. webauthn) if possible and failing that TOTP with the secret stored on the Yubikey, so if I had failed to switch authenticators before the Authy debacle at least I could still get into the important things. I also try to always download and store an encrypted copy of any backup codes, but not all services seem to provide them.

Show thread
Sign in to participate in the conversation
Qoto Mastodon

QOTO: Question Others to Teach Ourselves
An inclusive, Academic Freedom, instance
All cultures welcome.
Hate speech and harassment strictly forbidden.