Hi, I'm Daniel, Authy Founder. We've worked almost 18 months on this product, it's surreal to finally see it out.
Anyway, you can read more about why we did this here: http://blog.authy.com/thefuture
Anyway, you can read more about why we did this here: http://blog.authy.com/thefuture
Edit: suggestions - do not ask for cellphone number twice. Sending SMS PIN as a link is a bit weird.
But in general terms:
1. Authy tokens automatically sync even if you lose, change or upgrade phone.
2. Ability to do encrypted backups of Google Auth tokens. Same as above, they will sync if you lose, change or upgrade phone.
3. Bluetooth: Takes the hassle out of Two-Factor Auth.
4. Automatic time sync: Always makes sure your tokens work no matter what.
5. Key Rotation: We can automatically rotate keys if masters are compromised.
6. Privacy: WE DO NOT TRACK app usage or anything like it. We don't share data with anyone. Compare it to GAuth privacy policy.
So the tokens are stored on Authy's servers? Doesn't that defeat the purpose of two-factor? How do I (or an attacker) recover my tokens if I loose my phone?
Personally, I'd be concerned with trusting my credentials with any company unless all members of the leadership team (yes, including "nontech" people) are incredibly familiar with basic security terminology and practices.
(Note that the founder is unclear when PBKDF2 and AES are being used in the product, which is concerning, because they have very different use cases and should be hard to confuse).
I get the convenience factor, but my security relies on the absolute secrecy and control of those tokens; I'm not willing to trust those to anyone else. Any company that requires 2FA is likely to have a similar policy; leaking the keys to the kingdom to a third party which is not subject to security audits is going to be a non-starter.
Bluetooth integration is a compelling feature, though.
This looks awesome.
When could we expect a Windows 7/8 app ?
Congrats
Once we have the experience nailed out, we'll ported to other platforms.
Just a quick question, under security it says:
>>". Authy Bluetooth will only talk to pre-approved computers and all messages are encrypted."
Just wondering if you can speak to what sort of encryption and safeguards you've got going on here. The docs cover how the tokens are created, but not the communication between phone and mac.
Seems like an awesome thing but I wouldn't feel comfortable using it for work without knowing a bit more.
So even if Authy does nothing special to send the data encrypted, BT itself will ensure that it's safe. Minus, of course, some malware that's running and inspecting the application in-memory or just watching the clipboard, but no encryption on earth will help you there.
From what I can tell, the user navigates to a site previously provisioned with Authy, they choose to authenticate via Authy, and then ??? happens resulting in their cell phone giving them a time-limited one-time passphrase.
1. What is your business model ? The app looks great and I wouldn't want to see it go away in a couple of months.
2. There is a registration process that ties the app to my phone and there seem to be a recovery process. Does it mean that the secrets are stored on your servers ? If yes, what prevents you or one of your employees to gain access to the secret keys ?
2. The recovery process enables your phone. If you decided to enable backups(which is optional) encrypted versions of you accounts are stored in our servers (that's why it called backups). Authy employees can't gain access because only encrypted version is stored, you chose the encryption key and have to remember it.
We believe that the future of Two-Factor Auth is one were our devices will do the work for us in order to provide us a greater and simpler security.