End of Life for Twilio Authy Desktop App

Original Article ↗ Hacker News Discussion ↗

Twilio’s decision to end support for the Authy desktop app is prompting users to rethink how they handle two-factor authentication, especially those who relied on synchronized tokens across phone and computer for redundancy and convenience. Many are frustrated by how hard Authy makes it to export TOTP secrets, viewing this as vendor lock-in and a serious downside for something as critical as account security. Alternatives such as password managers with built-in TOTP, open‑source authenticators, and hardware keys are being weighed, with ongoing debate over the security trade-offs of storing passwords and second-factor codes in the same place or on the same device.

Data export, lock-in, and proprietary 2FA backends

  • Several posts say Authy intentionally makes exporting TOTP secrets difficult, citing “security” while effectively creating lock‑in.
  • Export often requires a specific legacy desktop version and technical steps (debug console, third‑party tools, rooted phone, copying XML/SQLite).
  • Deleting an Authy account can silently disable 2FA on accounts that use Authy as a backend (e.g., Twitch, historically Cloudflare), sometimes making recovery impossible.
  • Some services (e.g., SendGrid, at least in the past) required Authy‑specific codes, further enforcing ecosystem lock‑in.

Security model: passwords and TOTP in one place

  • Many are uneasy about storing passwords and TOTP in the same app, fearing loss of “true” second factor.
  • Counterargument: threat model is usually credential theft, not full device compromise; password manager already is the single point of failure.
  • Suggested approach:
    • Use a password manager as the main “auth service,” hardened with strong master password and hardware keys.
    • Keep especially sensitive accounts’ TOTP on a separate device or app, or in a rarely‑opened, more heavily‑encrypted vault.

Alternatives and migration strategies

  • Common replacements: Aegis, 2FAS, KeePass/KeePassXC (sometimes in a separate DB), Bitwarden, 1Password, Proton Pass, Ente Auth, browser extensions (e.g., authenticator.cc), and OS‑integrated solutions (Apple Keychain).
  • Some keep dual storage (e.g., Aegis + another manager) for redundancy and easier recovery.
  • A number of users regenerate TOTP secrets on each site instead of trying to extract them from Authy.

Desktop vs mobile, redundancy, and usability

  • The desktop app was valued for redundancy (phone lost/broken, battery dead, travel scenarios) and convenience when the phone isn’t nearby.
  • Many dislike becoming fully dependent on a single mobile device for access to “entire digital life.”
  • On Apple Silicon Macs, installing the iOS/iPadOS Authy app is highlighted as a stop‑gap, but not first‑class support.

Trust in Twilio and impact on 2FA adoption

  • Decision is widely viewed as short‑sighted cost‑cutting or a move to favor SMS/other revenue streams.
  • Some say this reinforces distrust of proprietary 2FA ecosystems and pushes them toward open‑source, self‑hosted, and easily exportable solutions.
  • A few worry that stories like this discourage non‑experts from adopting 2FA at all.