5

Authy looks like a great solution - especially for laymen, in order to simplify complexities - but I have some nagging concerns re privacy & security, especially when sensitive data is hosted "on cloud".

It's encouraging to see (some? most? all?) Authy source hosted @ GitHub, but has Authy actually had a PenTest or security review by an independent 3rd-party, and have the findings been made public?

Where is the data stored, how is it encrypted at rest & how has vulnerabilities been dealt with? If CVE='none', then that sets all sorts of alarm bells off.

I know some of this is addressed by their blog post, but would like a 2nd opinion to verify

Improve this question
2
  • So, you have the data you want, but you are looking for some separate source of a review. Unfortunately, "where can I find X?" or "where can I find a review?" type questions are off-topic.
    – schroeder ♦
    Sep 8, 2018 at 23:07
  • This is a very valid question and very important. Perhaps phrasing it "Are services like Authy secure (and why)?" would have seemed less "off-topic" and allow for such reviews to be used as references for suitable answers. Asking the service's provider seems rather naive unless you have the technical expertise to assess that info and see way past the marketing talk. And anyone having required expertise would not be asking a question. A pity this question is closed.
    – user218931
    Apr 7, 2021 at 7:49

1 Answer 1

Reset to default
1

As you stated, many of your questions are answered on Authy's blog on their post about Authy vs. Google Authenticator

The rest can be answered by contacting Authy via their contact form

I use Authy for 38 of my accounts (the rest don't use the Google Authenticator API) so you can easily say I trust it. It's all encrypted with a password that never leaves your device, so even if you use the built-in cloud backup nobody else can get your tokens. It also syncs to multiple devices so you can get your tokens on a phone, computer, tablet, etc. all at the same time (which the actual Google Authenticator app cannot do).

Improve this answer
3
  • 5
    Security posture seems similar to LastPass, in that it's implied to be a 0-knowledge implementation - i.e. data encrypted client-side & hosted online. 2 points that I'e been unable to find public knowledge about: * Has there been an independent 3rd-party security review (pen-test) & what were the findings? * How have they dealt with security issues, such as critical/0-day bugs & breaches? I'll contact the vendor for input, but they have a vested interest to ... "shape" the facts in favourably (wouldn't go as far as 'lie'). What would be more telling is an outsiders perspective.
    – jakes
    Aug 16, 2018 at 20:33
  • Why would one ask Authy to get an unbiased assessment?
    – user218931
    Apr 7, 2021 at 8:45
  • 1
    @jerry I didn't say to ask Authy for their own personal opinion of themselves, I said they can be contacted ( as in to find out if they've had any formal pen testing or audits) if it wasn't already stated on the blog post I had linked.
    – Jesse P.
    Apr 7, 2021 at 10:46

Not the answer you're looking for? Browse other questions tagged .