AFAIK rooting an Android phone necessitates a factory reset of the phone beforehand, so I don't think you'd be able to dump the MFA seeds before Authy is uninstalled (unless that's a hardware thing)
The main issue is that many apps will block rooted phones (banks, state apps and the like). Usually more trouble than it's worth.
The answer really depends. Root by what means? And to what end? Permanent or only temporarily?
Personally I reject with extreme prejudice the android security model (it's my &#^@ device not the vendor's). But I don't generally want to grant any apps root. Lineage strikes a nice balance by providing root adb.
Some apps such as Aegis allow exporting the MFA secrets.
I think they allow importing from Authy but only on rooted phones. I missed the train to move away from Authy in 2024 and now the only non-root option is to regenerate the seed from every provider one by one.
As other commenters said, rooting my main phone would lock me out of banking apps.
I suppose I could find an old phone, sync from authy cloud, root it, and then migrate, but then generating new seeds is probably both safer and faster at that point.
You can extract keys out of Authy using mitm-proxy. I have done it and switched to Bitwarden.
Importing is usually not an issue, as you can always enter the secret manually. It is the exporting that is the problem.
The secret looks something like this:
JBSW Y3DPF QQHO ....
(usually fairly short unless its google)
It's not quick, but you can submit a GDPR/Subject Access Request to Twilio and after a month or two they will send you all your Authy TOTP seeds.
Then you can import them into Aegis or some other FLOSS solution: https://github.com/uiltondutra/authy-migrate
That is alarming. They have access to the plaintext? And they will hand auth secrets out? That seems extremely wrong to me.
>...data arrives as a CSV in which every token is encrypted with your backup password...
Fair enough. That seems reasonable.
They always had access to the plaintext, they could do better to hand them out
So there is a real solution to that problem! Thanks a lot for sharing it
It was never particularly safe to root the phone - both because it drills a hole into the security model and because you don't have any good ways of verifying what apps asking for root actually do.
Moreover, most of root tools and ROMs are rather poorly written and glued together with other forum scripts which you have no way of checking if they're not malware. (There are exceptions.)
So no, "safe" it's not and never has been. The tradeoff might be worth it for you as a user though.
> The reason I'm asking is that I'm stuck with authy as a MFA code app, and would like to move to something that has both desktop and phone support, and my conclusion is I'd need to root my phone to get access to the actual MFA seeds (they don't allow exports to keep you stuck in their app).
The way to do that is to take the hit and recreate your 2FA codes in an opensource app like Aegis or Stratum.
Thanks for the summary. I agree with you about 2FA, but it's still annoying, I was hoping I would find a lazier solution.
Not sure why this is downvoted. It's accurate. A major problem is that when you root you loose assurance of the integrity of your /system partition. That means malware can now persist undetected.