Twilio reminds users that Authy Desktop apps die next month – not in August
- Reference: 1707996729
- News link: https://www.theregister.co.uk/2024/02/15/twilio_authy_eol/
- Source link:
The [1]clock is ticking for the Windows, macOS, and Linux versions, and Authy wants users to switch over to its mobile applications instead. The developer advised that the iOS app should also work with Apple hardware equipped with the M1 or M2 chip – which is not a lot of help for users running on Windows or Linux.
Authy is an application used to set up two-factor authentication. The app generates a code every 30 seconds, which can then be used to sign into a linked account. While vendors such as Microsoft and Google have authenticator apps of their own, Authy Desktop allows users to sign into services without having to squint at their phones.
[2]
Twilio acquired Authy in 2015, but has suffered turbulent times in recent years. In 2022, an attacker broke into several of the developer's [3]customer accounts after phishing its employees, and last month it [4]announced that Twilio's CEO, Jeff Lawson, was departing "with immediate effect."
[5]
[6]
Job cuts were also confirmed in 2023, and two business units – Twilio Data & Applications and Twilio Communications – were formed as the biz was reorganized.
[7]CEO of chat tech plumber Twilio is leaving the building
[8]Twilio axes roughly 1 in 5 staff in fresh round of layoffs
[9]Twilio more than decimates staff, CEO says it grew too fast
[10]1,900 Signal users exposed: Twilio attacker 'explicitly' looked for certain numbers
The announcement in January that Authy Desktop was going to be terminated in August was met with disappointment from users, and this unhappiness intensified [11]when the end of life date was shifted to March. One user [12]described the decision as "beyond absurd," while another [13]opined : "This is an excellent way to piss off thousands of developers and make sure we never touch any of your products again. A masterful gambit."
We asked Twilio to comment and will update this article should it respond.
Twilio [14]suggested some alternatives for users who wish to stick with the desktop version. It also admitted that, since the Authy app lacks an export feature, getting up and running in another application would require re-enabling the 2FA method and re-adding the token in the new application.
[15]
In January, when Twilio first announced it was to ax the Authy Desktop applications, it declared: "We made this difficult decision to sunset the Twilio Authy desktop apps in order to streamline our focus, and provide more value on existing product solutions."
That text is no longer on the support page – only a note that the apps previously scheduled for end of life in August 2024 will now reach the grim milestone on March 19. ®
Get our [16]Tech Resources
[1] https://support.authy.com/hc/en-us/articles/17592416719003-Business-customer-guide-End-of-Life-EOL-for-use-of-Authy-API-with-Twilio-Authy-Desktop-apps
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Zc5DQsPRXf4mTLB9h6uohwAAAIE&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.theregister.com/2022/08/08/twilio_phishing_attack/
[4] https://www.theregister.com/2024/01/09/twilio_ceo_steps_down_amid
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Zc5DQsPRXf4mTLB9h6uohwAAAIE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Zc5DQsPRXf4mTLB9h6uohwAAAIE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2024/01/09/twilio_ceo_steps_down_amid/
[8] https://www.theregister.com/2023/02/13/twilio_trims_workforce/
[9] https://www.theregister.com/2022/09/14/struggling_pandemic_darling_twilio_lays/
[10] https://www.theregister.com/2022/08/16/twilio_breach_fallout_signal_user/
[11] https://twitter.com/TwilioHelp/status/1757469957535781337
[12] https://twitter.com/ethangates/status/1757481712701911311
[13] https://twitter.com/MattEason/status/1757530011257471426
[14] https://help.twilio.com/articles/22771146070299-User-guide-End-of-Life-EOL-for-Twilio-Authy-Desktop-app
[15] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Zc5DQsPRXf4mTLB9h6uohwAAAIE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[16] https://whitepapers.theregister.com/
Found a silver lining
Always an upside. The alternatives suggested included Keepassxc which I have used for years as my password manager. Setting up to 2FA always featured Authy or Google Authenticator and I have both on various devices. I hadn't realised that Kepassxc had 2FA support (and its difficult to find without a tutorial). Then simple to setup and, of course, works on all devices accessing the same database.
So moving from one password manager and 2FA apps to just one combined. Result! Thank you Twilo for the fish and a reason to avoid your products in future too.
Re: Found a silver lining
Bitwarden also allows this feature on a paid plan ($10/yr) if you like your password manager hosted. There are a few scripts kicking around github that allow you to export all your secrets from authy desktop or the browser extension by pasting some code in the console. I used it to migrate all my authy stuff to bitwarden.
Re: Found a silver lining
When I first saw the suggestions, I looked into this and concluded KeePassXC was just a password manager. But you are right - it's there in the "Getting Started Guide" under "Database Operations" -> "Adding TOTP to an Entry".
The downside is that it has the opposite problem - its not available for phones! In theory if you can capture the original QR code then you could use it in combination with another authenticator app, but that seems painful.
Helpful corporate prompting
Well this was a useful reminder to sort out an alternative desktop solution:
"Ahoy! Just a friendly reminder about the EOL for Twilio Authy desktop app ending on March 19, 2024."
And this was a useful reminder to migrate away from all your services forever:
"Note: The Authy app lacks an export feature [and we have no intention of providing one even though we are leaving you with no other options, so suck it up buttercup]"
AXE
AXE AXE AXE
Re: AXE
The 'e' got axd
"We made this difficult decision to sunset the Twilio Authy desktop apps in order to streamline our focus, and provide more value on existing product solutions."
I expect the English translation is either "We've run out of money, so we're bailing" Or "Customers? Really, In this day and age who gives a damn about customers?"
No translation needed, it's pretty explicit: "provide more value on existing product solutions" = "make more money with what we have".
Of course some starry-eyed suckers might think that "providing value" might include them too, but in this case they're beyond help...
stupid names
Any product with a cod-cute made up name ending in -Y invokes extreme suspicion in this cynic's mind. Rightly, in this case.
"Authy Desktop allows users to sign into services without having to squint at their phones."
My employer requires me to use Microsoft Authenticator. It works just fine on Android-x86 inside a VirtualBox VM. No squinting required.
-A.
Find alternate provision
I just had to migrate Authy from my old phone to the new one, and it was dystopian to say the least. To unlock the accounts for migration to the new device required changing my password - but you can't change your password without first unlocking all the accounts. I tried contacting Twilio only to find their "support service" is 98% navigating an FAQ with wrong answers in and 2% finally getting in touch with a human being. It got sorted after much hoop jumping, but ye gods, it couldn't be less friendly if they had an option to "Press 3 to hear rude remarks about your wife and/or mother".
Check this out...
https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d958c93
This is a reminder that cloud versus on-prem remove some of the management burden but cloud providers can all pull these stunts and you just need to follow along. Real shame as the desktop client was ideal for systems that were shared amongst many users, such as in retail and hospitality.
Which is why they axed it. You can't go around providing a real service now can you.
What if app isn't an option?
I know of at least one organisation using Authy for 2FA in locations where mobile devices are forbidden for security purposes - only desktops/laptops accessing the network via wired LAN. Could be interesting to see how they cope when the desktop app ceases to be.
Another useful app dead in the wake of frenzied layoffs to please short-term investors