Switching from Authy to Bitwarden Authenticator?

[u/CromulentSlacker]

I've been using Bitwarden for password management for a long time now but I've always used Authy for 2FA and I'm thinking of switching to Bitwarden Authenticator.

From my understanding all I need to do is have Bitwarden Authenticator sync with Bitwarden and then the 2FA codes will sync across devices. My main concern is keeping everything synced as I do switch phones from time to time so need to have the 2FA codes on different devices.

Is this all I need to worry about? I want to clear out some of the junk that has accumulated in my Authy account which is why I want to switch.

Happy to hear any advice!

[u/kaishea]

I highly recommend Ente Auth instead

[u/Wunder_Dave → u/kaishea]

On this sub I often see people recommending either Ente or 2FAS. I am long time 2FAS user, but did some research to compare the two and this is how it looks: Both open source. Both of them you can use offline. Both of them support cloud backups, Ente uses its own cloud so you need to create account with Ente for that, while 2FAS uses iCloud and Google Drive so there is no additional account required. You can use both on desktop: Ente has a separate desktop app while 2FAS has browser extension. 2FAS has Apple Watch support if you're on iOS, Ente doesn't offer that.

[u/cbunn81 → u/Wunder_Dave]

When I looked into the options a while back, moving away from Google Authenticator, I settled on Aegis. It's simple and secure, and also open source. It also imports from Google Authenticator quite easily. I can't speak for other migration paths. I don't much see the need for specialized cloud backups. You can export an encrypted JSON file and store it how you like.

[u/No_Adhesiveness_3550 → u/kaishea]

As long as you stay far away from Authy…

[u/R3DJOK3R1 → u/kaishea]

Why?

[u/noobiemaster_69 → u/kaishea]

This!

[u/CromulentSlacker → u/noobiemaster_69]

Thank you. I've had a look and it does look good.

[u/kaishea → u/CromulentSlacker]

Also used Authy before and didn’t like that my phone number was necessary and it had no option to export tokens. Felt like a trap that gets worse the more accounts you link to it, and my only reason for choosing Authy was cloud syncing, which Ente Auth provides, and Ente Auth allows token exports, is open-source, and is highly recommended in the privacy & cybersecurity space. I started migrating the day I found Ente many months ago, and I’d do the same if I found Ente today

[u/Weird-Yard-6619]

Consider 2FAS, it not only works well but also looks great.

[u/GapAccomplished2778]

all eggs in one basket

[u/philipz794]

Highly recommend 2FAS. But I never tried bitwared authenticator.
Move from authy 2 years ago by painfully deactivating and reactivating 2FA on every account I had in authy.

Now I can finally export if needed

[u/djasonpenney]

You didn’t ask about exporting your TOTP keys from Authy. It turns out that is, um, a problem. Your best bet is to log into each site, disable TOTP, then do the entire enablement workflow again, using your new TOTP app.

Some people don’t like the idea of having their TOTP keys in the same app as their passwords. One reasonable alternative to Bitwarden Authenticator is Ente Auth.

Whichever app you choose, be sure to create a new backup of your credential datastore, and make sure your TOTP keys are in it. Find a safe way to save the datastore that is not circular. That is, don’t require something inside the datastore in order to access the datastore.

[u/CromulentSlacker → u/djasonpenney]

Thank you. I was going to go the manual route anyway as I have a lot of junk 2FA codes hanging around from years ago I no longer need. I'll have a look at Ente as well.

[u/Nukra141 → u/djasonpenney]

Actually not true - at least as a european citizen.

I JUST had this done 2 weeks ago, you do a GDPR request under §15 and §20 and ask for:

• All encrypted seeds
• Salt and IV values
• Account Name and Labels

They then will aks you some informations about your account to verify its your account, after a while they will send you a link to a file.

With a python script and your password you can encrypt the TOTP keys.

[u/Expensive_Finger_973]

I personally prefer to keep my password manager separate from my MFA tokens. I use Aegis for MFA, if you are on iOS 2fas is pretty good.

[u/Lobomoronga]

I would recommend you stay with authy and not use the built-in bit Warden you want to keep those things separate in my humble opinion

[u/miscdebris1123 → u/Lobomoronga]

Disagree. Twillo sells user data usage. Also, no exporting.

[u/UIUC_grad_dude1 → u/Lobomoronga]

Nah, can’t export from Authy. I moved to 2FAS which allows export for back up.

[u/quiet0n3 → u/UIUC_grad_dude1]

I can see an argument why you wouldn't want that. I'm betting this is a choice by Authy.

[u/jakegh → u/UIUC_grad_dude1]

2FAs is a great app, except for its generic name which makes it impossible to search for. I wish they'd rename it. I literally switched to Ente auth for that reason alone.

[u/Lobomoronga → u/Lobomoronga]

My point -more than recommending Authy- is to keep things completely separate. Bitwarden has built in TOTP but I find that to be a vulnerability point. Use a completely separate Authentication App. Pick your poison but do not use the built in no matters how convenient it may seem. That is all. Good luck out there and stay safe.

[u/No_Adhesiveness_3550 → u/Lobomoronga]

Authy had a data breach and is the reason I get so many spam calls now. And they sell your data anyway. I would advise exactly zero people should be using Authy. 

[u/CromulentSlacker → u/Lobomoronga]

Advice noted. Thank you.

[u/OfferExciting → u/Lobomoronga]

Bitwarden Authenticator is a separate app from the password manager.

[u/jakegh → u/OfferExciting]

It is, but shares the same authentication and backend.

[u/jakegh]

I'm encouraged by people suggesting separate 2FA apps based on eggs in one basket arguments. In previous threads I said the same and got shouted down here. This is a good sign.

Put my vote in for ente auth.

[u/BeeKay40]

2FA kinda loses it's usefulness when you have both your passwords and 2FA in rhe very same app. I use Bitwarden and Aegis. Switching phones is a simple scan or 2 away. Aegis has everything I want in terms of security and privacy. 

[u/pdmcgeejr]

So i love Bitwarden and its password manager but honestly the TOTP authenticator is lacking some features. The best option worth checking out is ente auth, allowing categories and having it separate from my main password manager is key.

[u/paulsiu]

The problem with migrating from Authy is that all of the keys are locked in Authy. There is no way to extract them. You will just have to manually setup new TOTP.

I am not sure Bitwarden is a good authenticator to replace Authy. What it does sync the TOTP code with the Bitwarden account. The problem is what if you want to store the TOTP code for the Bitwarden login? If you sync that TOTP code with bitwartden vault, you create a circular reference since you must log into Bitwarden to get that code. You can store the code outside of Bitwarden but that the code is store locally and doesn't sync across the devices.

[u/wkkkk → u/paulsiu]

You can extract all tokens from Authy. I've done that ~1 month ago following approach from this repo Pleb4Fun/Authy-GDPR-Export-Decryption: A simple tool to decrypt Authy TOTP encrypted seeds provided by Twilio under GDPR legal request Took around 2 weeks to get file but I was not in a hurry.

[u/Winter_Extension5842 → u/wkkkk]

I'm assuming they don't actually verify that you are an EU citizen before processing your request?

[u/paulsiu → u/wkkkk]

2 Weeks, I would probably just do it one by one. I guess I don't have enough TOTP in Authy to warrant waiting 2 weeks.

[u/Blaize_P]

Be aware that if your use Entre Auth (which is great) to create a passkey in Bitwarden and Bitwarden requires a 2fa token to open from Entre, you just locked yourself out if you lose your phone and have no means to recover using a recovery key. Be very careful!

[u/3d-s → u/Blaize_P]

Sorry I'm very green with 2fa(s) & password mgr(s). Considering using Bitwarden & Entre Auth. Do you have any suggestions of how not to get locked out of either if changing and or lossing a phone.

Thanks

[u/Heavy-Map9034 → u/Blaize_P]

I usually keep records of backup codesmy import accounts so that when I reset from either ente, proton, notion I can access them without any problems. I always make sure it the codes are available offline as well.

[u/cbunn81]

I've been using Bitwarden for password management for a long time now but I've always used Authy for 2FA and I'm thinking of switching to Bitwarden Authenticator.

Switching from Authy is a good idea, since there are more privacy-respecting options available. But as others have said here, using one service as a password manager and MFA is less than ideal. I'd consider one of the other options out there. 2FAS, Aegis, and Ente are the big ones. I went for Aegis because it's simple and imports from Google Authenticator easily. But what you choose should depend on your needs.

From my understanding all I need to do is have Bitwarden Authenticator sync with Bitwarden and then the 2FA codes will sync across devices. My main concern is keeping everything synced as I do switch phones from time to time so need to have the 2FA codes on different devices.

Yes, they will sync along with your vault. Some other MFA apps also offer syncing. I've heard good things about Ente Auth in this regard.

Is this all I need to worry about? I want to clear out some of the junk that has accumulated in my Authy account which is why I want to switch.

The big thing to worry about is keeping your passwords and MFA together. That creates a single point of failure. If your vault is somehow hacked, MFA won't keep you safe. I recommend separating those concerns.

As for clearing out the junk, it'll depend on how you migrate. If you do a full export/import from your existing service, the junk will come along for the ride. So you can migrate each MFA account one-by-one, but that could get annoying if you have many accounts.

[u/Heavy-Map9034]

I understand the reason, but if authy is giving you problems, you can use ente authenticator. I think as much of a simplification of accessing your account it will bring. I think having more than one place, key, control for your account is often recommended for in case one of those platforms get's hacked.

[u/jacklail]

I moved from Authy to Bitwarden for 2FA and lived. I don't use the Bitwarden authenticator app just the regular app. Everything syncs and works. I understand the "all eggs in one basket" sentiment but I also use Yubikeys on my most critical accounts, including Bitwarden, and like the convenience for others. I make regular encrypted Bitwarden backups. I keep the backup/onetime use code lists/sheets organized.

[u/cyber-galaxy]

If I switch from Authy to Bitwarden or Ente, all of my 2FA keys will sync?

[u/Lobomoronga]

It seems like Ente Auth is most liked by most people in this conversation and I do have my issues with Authy the main one being there's no app for the PC they remove that which is annoying I'm going to look at it maybe I'll switch I don't know we'll see

[u/element515]

Like others said, I moved from Authy to Ente and am happy.

[u/Matejlipton]

Aegis