Twilio kills off Authy for desktop, forcibly logs out all users

Twilio has finally killed off its Authy for Desktop application, forcibly logging users out of the desktop application.

In January, Twilio announced that the Authy desktop apps for Windows, macOS, and Linux would reach the end of life on March 19, 2024, and will ultimately be discontinued in August 2024.

While the desktop apps continued to work past March, when opened, they showed an alert warning that the program had reached end of life and that users should switch to the mobile versions immediately.

This ended about thirteen days ago when Twilio forcibly logged all desktop devices out of their Authy accounts and no longer allowed them to log back in with their phone numbers.

Those who have continued to use Authy for Desktop, even after all the warnings, have found that their 2FA accounts are gone unless they had previously synced them with a mobile device.

However, those who synced their desktop apps with the mobile versions have discovered that some of their tokens did not correctly synchronize, making their associate accounts inaccessible.

In June, threat actors found an unsecured Authy API that could be used to verify if a phone number was associated with a valid account.

The threat actors fed millions of phone numbers into the API, allowing them to build profiles of 33 million phone numbers on Authy, which were then leaked on a hacking forum.

Twilio fixed the bug by securing the API and releasing an updated mobile app version. Some believe that Authy desktop users cannot log in because the desktop app has not been updated with the new fix for the API.

However, in June, Authy released version 3.0, stating it would be the final desktop release, so we will unlikely see another one.

BleepingComputer contacted Twilio with questions about the end of Authy for desktop but a reply was not immediately available.