11–20 of 143 posts
https://www.yubico.com/products/yubico-authenticator/
That avoids keeping the seeds somewhere a general attack could get (and requiring a tap complicates attacks) and works across all of my devices. The main drawback is that there isn’t an easy way to install a seed on multiple keys when first enrolling.
I am considering switching from authy because it still doesn't have folders or collections or tags but the transition is annoying without root on android. Also wondering how people ensure they can restore if your phone dies?
edit: Also, it allows (after checking the "I know what I’m doing" warning) plaintext secret export, if you want that for some reason.
I am considering switching from authy because it still doesn't have folders or collections or tags but the transition is annoying without root on android. Also wondering how people ensure they can restore if your phone dies?
I’ve been migrating away from TOTP since it’s so easily phished but my current approach is to use Yubikeys with their app: https://www.yubico.com/products/yubico-authenticator/ That avoids keeping the seeds somewhere a general attack could get (and requiring a tap complicates attacks) and works across all of my devices. The main drawback is that there isn’t an easy way to install a seed on multiple keys when first en…
How well does it work on mobile? Totp via app, tap the nfc key to the phone?
And what does "no easy way" mean, how involved is that process? I’d prefer to have the keys on all 3 (or 4, not sure if the security key allows TOTP) sticks.
Who are Beem Development?
The killer feature for me is a way to quickly access tokens in my (cloud-side, encrypted) vault from a desktop (or web) app in case of emergency. It's not clear to me if Aegis allows this somehow? The other day I broke my phone. I was traveling and needed to do some 2FA level changes to a GH repo asap. I didn't even know there was an Authy desktop app until then. It saved my ass, literally.
Just keep TOTP in your password manager at this point. Whatever security is lost by it not being a "true second factor" is made up for by not having to recover or restore backups due to a lost or stolen phone.
Just keep TOTP in your password manager at this point. Whatever security is lost by it not being a "true second factor" is made up for by not having to recover or restore backups due to a lost or stolen phone.
Besides, if you dont have a physical and digital backup of your TOTP seeds you really like to live dangerously.