Slightly unrelated: is it relatively safe to root android phones nowadays or should I stick to the unrooted standard android? The reason I'm asking is that I'm stuck with authy as a MFA code app, and would like to move to something that has both desktop and phone support, and my conclusion is I'd need to root my phone to get access to the actual MFA seeds (they don't allow exports to keep you stuck in their app).

▲

throwa356262 2 hours ago | parent | next [-]

Some apps such as Aegis allow exporting the MFA secrets.

▲

gorgmah an hour ago | parent [-]

I think they allow importing from Authy but only on rooted phones. I missed the train to move away from Authy in 2024 and now the only non-root option is to regenerate the seed from every provider one by one. As other commenters said, rooting my main phone would lock me out of banking apps. I suppose I could find an old phone, sync from authy cloud, root it, and then migrate, but then generating new seeds is probably both safer and faster at that point.

	▲	shocks 14 minutes ago \| parent \| next [-]
		You can extract keys out of Authy using mitm-proxy. I have done it and switched to Bitwarden.
	▲	throwa356262 an hour ago \| parent \| prev [-]
		Importing is usually not an issue, as you can always enter the secret manually. It is the exporting that is the problem. The secret looks something like this: JBSW Y3DPF QQHO .... (usually fairly short unless its google)

▲

torben-friis 2 hours ago | parent | prev | next [-]

The main issue is that many apps will block rooted phones (banks, state apps and the like). Usually more trouble than it's worth.

▲

izacus 2 hours ago | parent | prev [-]

It was never particularly safe to root the phone - both because it drills a hole into the security model and because you don't have any good ways of verifying what apps asking for root actually do.

Moreover, most of root tools and ROMs are rather poorly written and glued together with other forum scripts which you have no way of checking if they're not malware. (There are exceptions.)

So no, "safe" it's not and never has been. The tradeoff might be worth it for you as a user though.

> The reason I'm asking is that I'm stuck with authy as a MFA code app, and would like to move to something that has both desktop and phone support, and my conclusion is I'd need to root my phone to get access to the actual MFA seeds (they don't allow exports to keep you stuck in their app).

The way to do that is to take the hit and recreate your 2FA codes in an opensource app like Aegis or Stratum.

	▲	gorgmah an hour ago \| parent [-]
		Thanks for the summary. I agree with you about 2FA, but it's still annoying, I was hoping I would find a lazier solution.