The main issue is that many apps will block rooted phones (banks, state apps and the like). Usually more trouble than it's worth.

* some apps.

Both of my banking apps work fine with a rooted GrapheneOS phone. If you want to have full control over your phone like you would a Linux laptop, to customize it to your own preferences and maximize privacy, there is nothing else gives you the same amount of control over the device that you bought and paid for.

The fact that people pay $1000 for a device and then not be able to fully uninstall pre-installed crapware nor fully block it from the internet is depressing.

GOS is not rooted by default - in fact, rooting breaks the GrapheneOS security model and is unsupported.

I don't care. It's my phone and I care more about my privacy and the ability to sandbox apps (useful every day) than I do about a border patrol agents trying to clone my phone. (Will statistically never happen to me)

Some apps such as Aegis allow exporting the MFA secrets.

I think they allow importing from Authy but only on rooted phones. I missed the train to move away from Authy in 2024 and now the only non-root option is to regenerate the seed from every provider one by one. As other commenters said, rooting my main phone would lock me out of banking apps. I suppose I could find an old phone, sync from authy cloud, root it, and then migrate, but then generating new seeds is probably both safer and faster at that point.

Importing is usually not an issue, as you can always enter the secret manually. It is the exporting that is the problem.

The secret looks something like this:

JBSW Y3DPF QQHO ....

(usually fairly short unless its google)

It's not quick, but you can submit a GDPR/Subject Access Request to Twilio and after a month or two they will send you all your Authy TOTP seeds.

Then you can import them into Aegis or some other FLOSS solution: https://github.com/uiltondutra/authy-migrate

That is alarming. They have access to the plaintext? And they will hand auth secrets out? That seems extremely wrong to me.

>...data arrives as a CSV in which every token is encrypted with your backup password...

Fair enough. That seems reasonable.

They always had access to the plaintext, they could do better to hand them out

So there is a real solution to that problem! Thanks a lot for sharing it

You can extract keys out of Authy using mitm-proxy. I have done it and switched to Bitwarden.

Good point, sadly ios only, I'm on android: https://ente.com/help/auth/migration/authy/ Or do you mean it also works on android but not documented?

The answer really depends. Root by what means? And to what end? Permanent or only temporarily?

Personally I reject with extreme prejudice the android security model (it's my &#^@ device not the vendor's). But I don't generally want to grant any apps root. Lineage strikes a nice balance by providing root adb.

I want the ability to grant specific apps root through Magisk. Tasker for example for tasks that change system level settings and adaway for system level adblocking, material files for accessing to root filesystem for pulling config files from apps, Swift Backups for backing up all my apps and their data.

It was never particularly safe to root the phone - both because it drills a hole into the security model and because you don't have any good ways of verifying what apps asking for root actually do.

Moreover, most of root tools and ROMs are rather poorly written and glued together with other forum scripts which you have no way of checking if they're not malware. (There are exceptions.)

So no, "safe" it's not and never has been. The tradeoff might be worth it for you as a user though.

> The reason I'm asking is that I'm stuck with authy as a MFA code app, and would like to move to something that has both desktop and phone support, and my conclusion is I'd need to root my phone to get access to the actual MFA seeds (they don't allow exports to keep you stuck in their app).

The way to do that is to take the hit and recreate your 2FA codes in an opensource app like Aegis or Stratum.

Thanks for the summary. I agree with you about 2FA, but it's still annoying, I was hoping I would find a lazier solution.

Not sure why this is downvoted. It's accurate. A major problem is that when you root you loose assurance of the integrity of your /system partition. That means malware can now persist undetected.

AFAIK rooting an Android phone necessitates a factory reset of the phone beforehand, so I don't think you'd be able to dump the MFA seeds before Authy is uninstalled (unless that's a hardware thing)

That was never the case back when I was rooting phones. Sometimes the phone would reboot immediately after getting root so that you could do something useful like installing recovery, but maybe something has changed.