101–110 of 121 posts
Earlier quoted context omitted.
I store my password manager (Bitwarden) TOTP code in my safe in QR code format. I keep all my other TOTPs in my password manager. My Bitwarden password is long (at least 40 characters long, I didn't count precisely) and never used or reused.
Doesn't it kinda defeat the point of storing TOTP codes in your password manager?
Bit OT: I’m interested in an open standard for “push” 2FA. Receive a push notification on Google or Apple’s standard platform, or at the least be able to open the app and just tap the account to send second factor auth (maybe when you open the app it queries all accounts to find which is currently waiting for auth). Are there security concerns blocking this?
Earlier quoted context omitted.
I don't see any reason to use it over andOTP, which has all those features and has been around years before Aegis. It even looks suspiciously similar to andOTP, if not heavily inspired by it.
* Aegis has a nicer design * Aegis has an extensive import functionality, andOTP does not seems to have it * andOTP relocks every time you switch apps, which can be annoying if you need multiple codes when you login to multiple services. In Aegis that behaviour is configurable * andOTP makes you choose between biometric encryption and password, Aegis supports both at the same time * andOTP supports tags, Aegis does n…
I think the fact that Aegis allows you to import from a number of other authenticators, notably proprietary ones, is an important feature in getting people to move over to an open source equivalent, which is something I respect.
One minor correction to what you said though - andOTP doesn't relock every time you switch apps. I tried this just now to verify this.
Earlier quoted context omitted.
* Aegis has a nicer design * Aegis has an extensive import functionality, andOTP does not seems to have it * andOTP relocks every time you switch apps, which can be annoying if you need multiple codes when you login to multiple services. In Aegis that behaviour is configurable * andOTP makes you choose between biometric encryption and password, Aegis supports both at the same time * andOTP supports tags, Aegis does n…
Thanks for responding. I should have mentioned I've been a user of andOTP for a few years so that's why I brought the comparison up. I wish more projects (including Aegis) mentioned what distinguishes themselves from very similar options. I think the fact that Aegis allows you to import from a number of other authenticators, notably proprietary ones, is an important feature in getting people to move over to an open s…
I usually switch apps by clicking on the icon on the home screen, rather than the task switcher.
When I launch it from the home screen it always re-locks.
Earlier quoted context omitted.
If it's secured by TOTP and a unique and secure password, it's not the weakest link.
This reduces the attack scope from two devices to one. If your computer or web browser is compromised then both your TOTP secrets and password secrets are in one basket. Storing TOTP on a separate device can make it significantly harder to compromise your accounts.
Been testing this - migrated from FreeOTP (redhad). I have a conflict on export of keys for backup. But then you kind of need it in the event you loose the phone (so you don't have to rely on sms or email to recover account access). Personally I think the best security I have seen is in Keybase or Matrix with the trusted devices concept. I like how keybase allows for one of the devices to be a paper device.
The opposition to export features by FreeOTP maintainers is idiotic, because there is no contract that TOTP seed never moves or lives only on one device. The only expectation is that it is not shared with 3rd parties and is carefully kept secret. At the same time, migrating to a new phone and having to change 30 different 2FA codes individually is untenable.
Earlier quoted context omitted.
I don't see any reason to use it over andOTP, which has all those features and has been around years before Aegis. It even looks suspiciously similar to andOTP, if not heavily inspired by it.
* Aegis has a nicer design * Aegis has an extensive import functionality, andOTP does not seems to have it * andOTP relocks every time you switch apps, which can be annoying if you need multiple codes when you login to multiple services. In Aegis that behaviour is configurable * andOTP makes you choose between biometric encryption and password, Aegis supports both at the same time * andOTP supports tags, Aegis does n…
My big thing with these apps, Authy, Duo, Google Authenticator is site icons. Authy finally figured out a way to query the website and either get the favicon or some image from the website. I know, it's really the most minuscule part but it frustrates me to see "(D)" for Digital Ocean. But it's enough to keep me with it.