Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Aegis Authenticator – Secure 2FA App for Android

getaegis.app

Post reply on HN
Print view View original

41–50 of 143 posts

Re: Aegis Authenticator – Secure 2FA App for Android

#41

Post by howinteresting »

arepublicadoceu wrote: post #20
Lucent wrote: post #17

Just keep TOTP in your password manager at this point. Whatever security is lost by it not being a "true second factor" is made up for by not having to recover or restore backups due to a lost or stolen phone.

I would argue that the most important account to have TOTP enabled IS your password manager. So, if you already have a TOTP app to generate codes for your Password Manager why not consolidate it? Besides, if you dont have a physical and digital backup of your TOTP seeds you really like to live dangerously.

2fa for your password manager is good, but that doesn't have to be TOTP. That can just as well be something like the 1password secret key (something you have).

Re: Aegis Authenticator – Secure 2FA App for Android

#42

Post by alexbakker »

branon wrote: post #39

Recently had a hard time exporting 20+ OTP secrets from Google Authenticator. I believe I discovered a bug in the app: if you long press a secret > edit > leave an empty string as the comment, and then export a QR code containing this secret, your other device will fail to import ("QR code cannot be interpreted."). I've only seen this happen with secrets where the comment is put in parentheses and appended to the reg…

There's a third option to switch from Google Authenticator to Aegis. You can simply scan those export QR codes of Google Authenticator with Aegis.

Re: Aegis Authenticator – Secure 2FA App for Android

#44

Post by pluc »

virtualritz wrote: post #8

The killer feature for me is a way to quickly access tokens in my (cloud-side, encrypted) vault from a desktop (or web) app in case of emergency. It's not clear to me if Aegis allows this somehow? The other day I broke my phone. I was traveling and needed to do some 2FA level changes to a GH repo asap. I didn't even know there was an Authy desktop app until then. It saved my ass, literally.

Yubikeys store everything on the key. I can lose my phone and use your phone to see my 2FA codes. It's honestly one of the only way MFA make sense - otherwise you lock yourself out of your entire digital life when you lose your phone and need to rely on storing your backup codes (which opens up a storage security wormhole).

It's also a lot easier to wear around your neck.

Re: Aegis Authenticator – Secure 2FA App for Android

#47

Post by acdha »

psanford wrote: post #35
acdha wrote: post #11

I’ve been migrating away from TOTP since it’s so easily phished but my current approach is to use Yubikeys with their app: https://www.yubico.com/products/yubico-authenticator/ That avoids keeping the seeds somewhere a general attack could get (and requiring a tap complicates attacks) and works across all of my devices. The main drawback is that there isn’t an easy way to install a seed on multiple keys when first en…

If you are using the yubico-authenticator app then you are using TOTP, just with the seeds stored on your yubikey. This is still vulnerable to phishing. I hope what you meant to say is that you are switching to using WebAuthn with your yubikey on all sites that support it, and then using your yubikey for TOTP on sites that don't support WebAuthn yet. WebAuthn is the thing that gives you actual protection against phis…

Yes, that's exactly what I meant: I use the same Yubikeys for authentication, but fail back to TOTP when sites don't support something secure.

Re: Aegis Authenticator – Secure 2FA App for Android

#48

Post by unethical_ban »

Lucent wrote: post #17

Just keep TOTP in your password manager at this point. Whatever security is lost by it not being a "true second factor" is made up for by not having to recover or restore backups due to a lost or stolen phone.

If you have a TOTP app that allows exoprts, I agree.

If the individual site allows backup codes, I agree.

But you first need an app that hosts your TOTP that has exportable secrets.

Re: Aegis Authenticator – Secure 2FA App for Android

#49

Post by kevinfiol »

yewenjie wrote: post #46

I was happily using andOTP but seems like it has been unmaintained since June - https://github.com/andOTP/andOTP . I wish F-Droid or Play Store had a feature like GitHub's 'Archived' to inform users.

I'm still using andOTP and I prefer it over Aegis. Are there any reasons to stop using it if it still works? What kind of security vulnerability can affect it? Honest questions.

Re: Aegis Authenticator – Secure 2FA App for Android

#50

Post by acdha »

Semaphor wrote: post #15
acdha wrote: post #11

I’ve been migrating away from TOTP since it’s so easily phished but my current approach is to use Yubikeys with their app: https://www.yubico.com/products/yubico-authenticator/ That avoids keeping the seeds somewhere a general attack could get (and requiring a tap complicates attacks) and works across all of my devices. The main drawback is that there isn’t an easy way to install a seed on multiple keys when first en…

I use webauthn where ever available, but considering how rare that is, I might start using this. How well does it work on mobile? Totp via app, tap the nfc key to the phone? And what does "no easy way" mean, how involved is that process? I’d prefer to have the keys on all 3 (or 4, not sure if the security key allows TOTP) sticks.

Yes - on my desktops and laptops, I use USB. For my phones, I use the same keys with NFC. Basically you start the app, tap the key next to the phone, and then copy/paste the code. It means that my daily two factor needs are handled by the Yubikey I keep on my badge lanyard for both modern and legacy sites.

"No easy way" basically means that you either have to save the seed and repeat the setup process for your backup key or enroll two separate devices if allowed. It feels like the authenticator app could have a useful addition where it'd automate that for you if you have two keys present.

Post reply on HN