Authy
| Authy | |
|---|---|
 | |
| Original author | Authy Inc. |
| Developer | Twilio |
| Release | August 2012 |
| Operating system | |
| Type | Two-factor authentication |
| License | Proprietary |
| Website | www |
Authy (also known as Twilio Authy)[1] is a two-factor authentication (2FA) mobile app. Originally released in 2012 by Authy Inc., the app was acquired by American communications firm Twilio in 2015.[2][3] Authy provides online backup for security tokens, and users must register an account with a phone number prior to using the app.[4] It supports the Android and iOS operating systems.[5] In 2022 and 2024, Authy experienced data breaches involving user accounts and phone numbers.[6][7]
History
[edit]Authy Inc. founders Daniel Palacio and Gleb Chuvpilo were accepted into the Y Combinator startup accelerator program in late 2011.[8] The initial version of Authy was released in August 2012.[2] In 2014, Authy Inc. raised $3 million in a series A round.[9][10] At the time, Authy charged companies for its API, which allowed websites to validate each login with a one-time password (OTP) delivered to the user's device. Companies that implemented the API were billed every time a user signed up or logged in via Authy.[9] Twilio acquired Authy Inc. in February 2015 and indicated that Authy would be integrated with Twilio's API.[3][11]
Authy maintained a Chrome App and browser extension for Google Chrome from April 2014 until the deprecation of the Chrome App platform in 2020.[12][13] The Windows and macOS desktop applications for Authy were released in 2017,[14] followed by a beta version of the Linux application in 2020.[15] Authy discontinued its Windows, macOS, and Linux applications in August 2024.[5][16] Because Authy did not include a data export feature, users who switched to another two-factor authentication (2FA) app had to disable 2FA on each of their accounts before re-enabling it with the new app.[5][17]
Security incidents
[edit]Twilio employees were targeted by an SMS phishing campaign in August 2022 that resulted in a data breach impacting 209 of Twilio's client organizations, after which the hackers compromised 93 Authy accounts and linked them to their own devices.[6][18][19][20] In a July 2024 data breach, hacker group ShinyHunters used an unsecured Twilio API to collect the phone numbers of 33 million Authy accounts.[7][21][22][23]
See also
[edit]References
[edit]- ↑ Speed, Richard (February 15, 2024). "Twilio reminds users that Authy Desktop apps die in March". The Register. Retrieved August 23, 2026.
- 1 2 Finley, Klint (July 31, 2013). "Startup Vows to Save Everyone From the Epic Hack". Wired. Retrieved August 22, 2026.
- 1 2 Hesseldahl, Arik (February 24, 2015). "Twilio in Deal to Acquire Security Startup Authy". Vox. Retrieved August 22, 2026.
- ↑ Key, Kim (March 19, 2026). "Authy Review: Sleek and Reliable, But Short on Flexibility". PCMag. Retrieved August 22, 2026.
- 1 2 3 Roth, Emma (January 8, 2024). "Authy is shutting down its desktop app". The Verge. Retrieved August 22, 2026.
- 1 2 Newman, Lily Hay (August 26, 2022). "Why the Twilio Breach Cuts So Deep". Wired. Retrieved August 22, 2026.
- 1 2 Roth, Emma (July 3, 2024). "Twilio alerts Authy two-factor app users that "threat actors" have their phone numbers". The Verge. Retrieved August 22, 2026.
- ↑ Shontell, Alyson (December 7, 2011). "This Russian Model Is Headed To Y Combinator". Business Insider. Retrieved August 24, 2026.
- 1 2 Kolodny, Lora (September 8, 2014). "Authy Raises $3M to End Nude-Photo Theft And Other Fraudulent Hacks". The Wall Street Journal. Retrieved August 22, 2026.
- ↑ Kim, Eugene (September 9, 2014). "A Group Of High-Profile Investors Is Making A $3 Million Bet On A Startup That's Trying To Kill Passwords". Business Insider. Retrieved August 22, 2026 – via Yahoo Finance.
- ↑ Chapman, Lizette (February 24, 2015). "Twilio Buys Authy in Its First Acquisition". The Wall Street Journal. Retrieved August 24, 2026.
- ↑ Lardinois, Frederic (April 28, 2014). "Authy Brings Two-Factor Authentication To The Desktop". TechCrunch. Retrieved August 22, 2026.
- ↑ "Authy for Chrome App & Extension End of Life". Authy. February 21, 2020. Retrieved August 22, 2026.
- ↑ Schwan, Ben (July 28, 2017). "Authy: App für Einmalpasswörter auf dem Mac" [Authy: App for one-time passwords on the Mac]. Heise Online (in German). Retrieved August 22, 2026.
- ↑ "Announcing General Availability of Authy Desktop for Linux". Authy. June 11, 2021. Retrieved August 22, 2026.
- ↑ Abrams, Lawrence (August 1, 2024). "Twilio kills off Authy for desktop, forcibly logs out all users". Bleeping Computer. Retrieved August 22, 2026.
- ↑ Toulas, Bill (January 8, 2024). "Twilio will ditch its Authy desktop 2FA app in August, goes mobile only". Bleeping Computer. Retrieved August 22, 2026.
- ↑ Page, Carly (August 26, 2022). "Twilio says breach compromised Authy two-factor app users". TechCrunch. Retrieved August 22, 2026.
- ↑ Szpytek, Peter Hunt (August 26, 2022). "Hackers breached 2FA accounts of some Authy users, Twilio confirms". Digital Trends. Retrieved August 22, 2026.
- ↑ Page, Carly (October 28, 2022). "Twilio hack investigation reveals second breach, as the number of affected customers rises". TechCrunch. Retrieved August 22, 2026.
- ↑ Abrams, Lawrence (July 3, 2024). "Hackers abused API to verify millions of Authy MFA phone numbers". Bleeping Computer. Retrieved August 22, 2026.
- ↑ Fadilpašić, Sead (July 4, 2024). "Twilio confirms hackers accessed Authy user phone numbers". TechRadar. Retrieved August 22, 2026.
- ↑ Franceschi-Bicchierai, Lorenzo (July 3, 2024). "Twilio says hackers identified cell phone numbers of two-factor app Authy users". TechCrunch. Retrieved August 22, 2026.