Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Aegis Authenticator – Secure 2FA App for Android

getaegis.app

Post reply on HN
Print view View original

51–60 of 143 posts

Re: Aegis Authenticator – Secure 2FA App for Android

#51

Post by unethical_ban »

arepublicadoceu wrote: post #20
Lucent wrote: post #17

Just keep TOTP in your password manager at this point. Whatever security is lost by it not being a "true second factor" is made up for by not having to recover or restore backups due to a lost or stolen phone.

I would argue that the most important account to have TOTP enabled IS your password manager. So, if you already have a TOTP app to generate codes for your Password Manager why not consolidate it? Besides, if you dont have a physical and digital backup of your TOTP seeds you really like to live dangerously.

The one place I intentionally don't have TOTP is my password manager.

there is a base case somewhere in a backup strategy where TOTP is not feasible. The base case for me is "Keepass file backed up to multiple locations and my master key written down in an envelope in my house in case I hit my head".

Why would I lock my passwords away behind a TOTP that can get lost? My TOTP in Authy is protected by a long random key. Where do I store the key? In my password manager.

You can't use a password manager and TOTP to back each other up.

Re: Aegis Authenticator – Secure 2FA App for Android

#52

Post by rsync »

virtualritz wrote: post #8

The killer feature for me is a way to quickly access tokens in my (cloud-side, encrypted) vault from a desktop (or web) app in case of emergency. It's not clear to me if Aegis allows this somehow? The other day I broke my phone. I was traveling and needed to do some 2FA level changes to a GH repo asap. I didn't even know there was an Authy desktop app until then. It saved my ass, literally.

"I didn't even know there was an Authy desktop app until then. It saved my ass, literally."

That's a really unexpected outcome - can you provide any details ?

Re: Aegis Authenticator – Secure 2FA App for Android

#53

Post by [deleted] »

virtualritz wrote: post #8

The killer feature for me is a way to quickly access tokens in my (cloud-side, encrypted) vault from a desktop (or web) app in case of emergency. It's not clear to me if Aegis allows this somehow? The other day I broke my phone. I was traveling and needed to do some 2FA level changes to a GH repo asap. I didn't even know there was an Authy desktop app until then. It saved my ass, literally.

[deleted]

Re: Aegis Authenticator – Secure 2FA App for Android

#54

Post by arepublicadoceu »

unethical_ban wrote: post #51
arepublicadoceu wrote: post #20

Earlier quoted context omitted.

I would argue that the most important account to have TOTP enabled IS your password manager. So, if you already have a TOTP app to generate codes for your Password Manager why not consolidate it? Besides, if you dont have a physical and digital backup of your TOTP seeds you really like to live dangerously.

The one place I intentionally don't have TOTP is my password manager. there is a base case somewhere in a backup strategy where TOTP is not feasible. The base case for me is "Keepass file backed up to multiple locations and my master key written down in an envelope in my house in case I hit my head". Why would I lock my passwords away behind a TOTP that can get lost? My TOTP in Authy is protected by a long random key…

I realise now that I was not clear on my post. Using TOTP or second factor is useful for those heathens that insist in using cloud based service for password manager (I'm one). Not for local keepass/pass synced by syncthing/rsync/ssh etc.

I treat my kdbx as a single password encrypted backup of my bitwarden vault on my computer and external hard-drive.

I care much less about second factor if it's something offline on my computer than something accessible by a web interface to anyone in the world.

Re: Aegis Authenticator – Secure 2FA App for Android

#55

Post by yellowapple »

kevinfiol wrote: post #49
yewenjie wrote: post #46

I was happily using andOTP but seems like it has been unmaintained since June - https://github.com/andOTP/andOTP . I wish F-Droid or Play Store had a feature like GitHub's 'Archived' to inform users.

I'm still using andOTP and I prefer it over Aegis. Are there any reasons to stop using it if it still works? What kind of security vulnerability can affect it? Honest questions.

I'm wondering the same thing. It also looks like while Aegis is actively developed on GitHub, that hasn't materialized into a new release on the Play Store or F-Droid in 7 months.

Re: Aegis Authenticator – Secure 2FA App for Android

#56

Post by alexbakker »

yellowapple wrote: post #55
kevinfiol wrote: post #49

Earlier quoted context omitted.

I'm still using andOTP and I prefer it over Aegis. Are there any reasons to stop using it if it still works? What kind of security vulnerability can affect it? Honest questions.

I'm wondering the same thing. It also looks like while Aegis is actively developed on GitHub, that hasn't materialized into a new release on the Play Store or F-Droid in 7 months.

You're right, it's been a while, but we actually issued a beta release for 2.1 today!

Re: Aegis Authenticator – Secure 2FA App for Android

#57

Post by SoftTalker »

pluc wrote: post #44
virtualritz wrote: post #8

The killer feature for me is a way to quickly access tokens in my (cloud-side, encrypted) vault from a desktop (or web) app in case of emergency. It's not clear to me if Aegis allows this somehow? The other day I broke my phone. I was traveling and needed to do some 2FA level changes to a GH repo asap. I didn't even know there was an Authy desktop app until then. It saved my ass, literally.

Yubikeys store everything on the key. I can lose my phone and use your phone to see my 2FA codes. It's honestly one of the only way MFA make sense - otherwise you lock yourself out of your entire digital life when you lose your phone and need to rely on storing your backup codes (which opens up a storage security wormhole). It's also a lot easier to wear around your neck.

So you've moved the worry from losing/breaking your phone to losing/breaking your YubiKey?

Re: Aegis Authenticator – Secure 2FA App for Android

#58

Post by PufPufPuf »

virtualritz wrote: post #8

The killer feature for me is a way to quickly access tokens in my (cloud-side, encrypted) vault from a desktop (or web) app in case of emergency. It's not clear to me if Aegis allows this somehow? The other day I broke my phone. I was traveling and needed to do some 2FA level changes to a GH repo asap. I didn't even know there was an Authy desktop app until then. It saved my ass, literally.

You can export the vault (encrypted or not) to a cloud provider (like Google Drive). It's a manual process, but it's simple and quick. Besides, how often do you add new 2FA tokens anyway?

Re: Aegis Authenticator – Secure 2FA App for Android

#59

Post by plumeria »

howinteresting wrote: post #41
arepublicadoceu wrote: post #20

Earlier quoted context omitted.

I would argue that the most important account to have TOTP enabled IS your password manager. So, if you already have a TOTP app to generate codes for your Password Manager why not consolidate it? Besides, if you dont have a physical and digital backup of your TOTP seeds you really like to live dangerously.

2fa for your password manager is good, but that doesn't have to be TOTP. That can just as well be something like the 1password secret key (something you have).

I think that's the idea behind using a key file and a password in KeepassXC.

Re: Aegis Authenticator – Secure 2FA App for Android

#60

Post by cbsmith »

Rygian wrote: post #36
GordonS wrote: post #34

I switched to Aegis recently, and I did it for only 2 reasons: 1) I prefer to use OSS when possible 2) Aegis supports import/export/backup - so if I get a new phone, I don't have to spend days setting up my dozens of accounts again! This also means I can setup the same OTPs in both Keepass and my phone, so I can always get into my accounts I'm really liking it, it does the same job as the Google and Microsoft Authent…

I can import/export with Google authenticator (via QR codes).

Tends not to work to well in the scenario where you drop your phone into the ocean.
Post reply on HN