Getting Authy back on Apple Silicon Macs

dump.py

from mitmproxy import http, ctx

class AuthyFilter:
    def __init__(self):
        self.output_file = "attestation-access-token"

    def load(self, loader):
        # Set allow_hosts to only include api.authy.com
        ctx.options.allow_hosts = ["api.authy.com"]

    def request(self, flow: http.HTTPFlow) -> None:
        # Only process requests to api.authy.com/json/users/...
        if flow.request.pretty_host == "api.authy.com" and "/json/users/" in flow.request.path:
            # Check if the 'attestation-access-token' header is present
            attestation_token = flow.request.headers.get("attestation-access-token")
            if attestation_token:
                self.log_attestation_token(attestation_token)

    def log_attestation_token(self, token: str):
        # Overwrite the file with the token
        with open(self.output_file, "w") as f:
            f.write(token)
        print(f"Logged attestation-access-token to file")

addons = [
    AuthyFilter()
]

Getting Authy back on Apple Silicon Macs.md

Getting Authy back on Apple Silicon Macs

For some reason, Twilio has disabled the ability to install the iPad version of Authy on Apple Silicon Macs. With Authy Desktop also being discontinued, this means that there is no longer an official way to use the Authy app on macOS anymore. This guide is a workaround I found to trick sideloaded versions of Authy into signing in successfully, and using that with a sideloaded version of the Authy iPad app on macOS gives us the ability to use Authy on Mac again.

What's needed for this guide:

1. An iOS/iPadOS device with Authy installed normally
2. An Apple Silicon Mac with Authy sideloaded
3. mitmproxy
4. A decrypted and signed Authy IPA
5. Technical skill and patience

Step 1: Setting up mitmproxy

mitmproxy is a tool used to inspect and modify HTTP and HTTPS requests, and it's needed so that attestation tokens can be dumped from a legitimate iOS/iPadOS device and used on your Mac. Install mitmproxy on your Mac through brew or another method shown on mitmproxy.org, and then trust the mitmproxy root CA on both your Mac and iOS device (https://docs.mitmproxy.org/stable/concepts-certificates/). On iOS, you must trust the root certificate after installing it by going to Settings -> General -> About -> Certificate Trust Settings and enabling trust for mitmproxy.

Step 2: Dumping attestation token

You need an iOS/iPadOS device for this step with a normal version of Authy installed from the App Store. Start mitmproxy with the "dump.py" script attached (mitmproxy -s dump.py) in a convenient directory where you'd like the attestation token file to be stored. Next, connect your iOS/iPadOS device to the proxy by going to Settings -> Wi-Fi -> (your network) -> Configure Proxy, switching the setting to Manual, and entering your computer's private IP on port 8080 as the proxy. Once connected to the proxy, open the Authy app, type in your country code and phone number, and hit Submit and Yes. If it goes to the next screen and "Logged attestation-access-token to file" appears on the mitmproxy console, the attestation token has successfully been dumped, and you can now close the Authy app, disconnect from the proxy on your iOS device, and shut down the proxy by hitting "qy" on your keyboard. Please note that the attestation token is only valid for 10 minutes and will need to be dumped again if not replayed within that time.

Step 3: Sideloading Authy

You need to find a decrypted version of the Authy app for iPhone/iPad, sign it, and install it on your Mac. No modifications to the IPA are necessary for this guide. I used a decrypted version of Authy 26.2.2 from my jailbroken iPad Air 2 and signed it with my Apple Developer certificate, but you should be fine using a decrypted IPA from the internet and signing it through a free developer account or signing service. Once Authy is sideloaded, proceed to the next step.

Step 4: Replaying attestation token

Start mitmproxy again in the same directory, this time with the "replay.py" script attached (mitmproxy -s replay.py). Connect your Mac to the proxy by enabling "Web proxy (HTTP)" and "Secure web proxy (HTTPS)" in System Settings -> Wi-Fi -> (your network) -> Proxies and set the address and port to 127.0.0.1 and 8080 respectively. Next, open the Authy app, and complete the sign-in process like you usually would. If all goes well and you have successfully signed in and decrypted your TOTP codes, you can now disconnect and stop the proxy, and Authy should be fully functional on your Mac. If you encounter an error saying the attestation token is invalid, re-dump it and try again.

replay.py

from mitmproxy import http, ctx

class AuthyTokenAdder:
    def __init__(self):
        self.token_file = "attestation-access-token"

    def load(self, loader):
        # Set allow_hosts to only include api.authy.com
        ctx.options.allow_hosts = ["api.authy.com"]

    def request(self, flow: http.HTTPFlow) -> None:
        # Only process requests to api.authy.com/json/users/...
        if flow.request.pretty_host == "api.authy.com" and "/json/users/" in flow.request.path:
            # Read the attestation-access-token from the file
            try:
                with open(self.token_file, "r") as f:
                    token = f.read().strip()
                    if token:
                        # Add the token as a header
                        flow.request.headers["attestation-access-token"] = token
                    else:
                        print("Token file not found or empty")
            except FileNotFoundError:
                print(f"Token file not found or empty.")

addons = [
    AuthyTokenAdder()
]