Live data from Hacker News

Ask HN: Recommended two-factor authenticator app for personal use?

news.ycombinator.com

1–10 of 42 posts

Ask HN: Recommended two-factor authenticator app for personal use?

#1
I haven't really looked into authenticator apps before, but with the increases in SIM-jacking I think it's time. I don't use Google, so Google Authenticator is out. I use Duo at work; can you use that for arbitrary personal services? Are there others apps that come recommended?

Also, just general questions: are these apps usually free (if not, free isn't a hard requirement)? Is there some standard, or does each service only support a subset of apps? What happens if you lose your phone?

Any info is appreciated

Edit: One more question: I see rumblings from some people about using password managers as an alternative to 2FA apps. Is that a valid strategy? Does one make the other redundant?

Edit 2: I found this excellent deep-dive on the overall mechanism and the major players: https://arstechnica.com/information-technology/2020/05/choosing-2fa-authenticator-apps-can-be-hard-ars-did-it-so-you-dont-have-to/ Based on this I'll probably go with Authy

Re: Ask HN: Recommended two-factor authenticator app for personal use?

#4
post #2

I use Microsoft’s Authenticator and so far have had no problems. I also use 1Password’s built in 2FA functionality which is a little redundant but it makes filling in 2FA code on websites and apps very easy.

Using tools like 1Password and Bitwarden to manage your OTP codes, while arguably better than not using OTP at all, is a bad idea.

If you password for $service is exposed in a dump then you're ok but if your password manager is exposed then both factors of credentials are exposed. Using a separate app is definitely more secure.

You can use Google Authenticator without being a Google user, but Authy is another pretty reputable app which might be worth a look.

Re: Ask HN: Recommended two-factor authenticator app for personal use?

#7
Aegis, it's FOSS and supports encrypted backups. Migrating to a new device is trivial.

Best of all: it even supports 7 digit TOTP that previously required Authy (I think Cloudflare and HumbleBundle use this variant).

https://github.com/beemdevelopment/Aegis

Re: Ask HN: Recommended two-factor authenticator app for personal use?

#10
post #2

I use Microsoft’s Authenticator and so far have had no problems. I also use 1Password’s built in 2FA functionality which is a little redundant but it makes filling in 2FA code on websites and apps very easy.

Just so you know- the article I've now linked in the original post found some nontrivial issues with Microsoft's Authenticator
Post reply on HN