I just put a 2FA implant in my arm
I’d much prefer having my phone stolen than my arm stolen.
You need to meet every kid I know
Aegis Authenticator – Secure 2FA App for Android
111–120 of 143 posts
Re: Aegis Authenticator – Secure 2FA App for Android
#112The killer feature for me is a way to quickly access tokens in my (cloud-side, encrypted) vault from a desktop (or web) app in case of emergency. It's not clear to me if Aegis allows this somehow? The other day I broke my phone. I was traveling and needed to do some 2FA level changes to a GH repo asap. I didn't even know there was an Authy desktop app until then. It saved my ass, literally.
Yubikeys store everything on the key. I can lose my phone and use your phone to see my 2FA codes. It's honestly one of the only way MFA make sense - otherwise you lock yourself out of your entire digital life when you lose your phone and need to rely on storing your backup codes (which opens up a storage security wormhole). It's also a lot easier to wear around your neck.
My Yubikey always loses its credentials. (If anyone else knows about it and have a fix I'm all ears.)
I guess I need a new one, but what I want to say is don't rely on a single Yubikey or even two. Do have backups.
Re: Aegis Authenticator – Secure 2FA App for Android
#113The killer feature for me is a way to quickly access tokens in my (cloud-side, encrypted) vault from a desktop (or web) app in case of emergency. It's not clear to me if Aegis allows this somehow? The other day I broke my phone. I was traveling and needed to do some 2FA level changes to a GH repo asap. I didn't even know there was an Authy desktop app until then. It saved my ass, literally.
AEGIS has this killer feature, with the encrypted database, which I could sync to my local Nextcloud instance. Otherwise, loosing the phone would always mean loosing all your OTPs. Aegis is a direct (better) replacement for Google Authenticator.
Re: Aegis Authenticator – Secure 2FA App for Android
#114I hope that Passkeys would make TOTP obsolete soon. It's done its job during the era of reused passwords, but now it's unwieldy and unnecessarily prone to phishing.
Re: Aegis Authenticator – Secure 2FA App for Android
#115The killer feature for me is a way to quickly access tokens in my (cloud-side, encrypted) vault from a desktop (or web) app in case of emergency. It's not clear to me if Aegis allows this somehow? The other day I broke my phone. I was traveling and needed to do some 2FA level changes to a GH repo asap. I didn't even know there was an Authy desktop app until then. It saved my ass, literally.
There's a python script to decrypt the vault which you can use from a desktop with a little bit of code.
https://github.com/beemdevelopment/Aegis/blob/master/docs/de...
Re: Aegis Authenticator – Secure 2FA App for Android
#116Earlier quoted context omitted.
So you've moved the worry from losing/breaking your phone to losing/breaking your YubiKey?
I keep a second key as backup for this reason, which honestly is overkill and I only do because I got a second one for free at a conference. Easier solution (which I also use in case I someday need the second one only to discover that the blue smoke leaked out) is to just print out the TOTP secrets and keep them somewhere. I'm usually printing out recovery codes when I get a new TOTP secret so this has never felt lik…
Everyone should read this risk mitigation solution for loosing 2FA. I always think about printing recovery codes, but having keepass vault with those codes also sounds great. You may even have some random password there and store it printed out in some locations just for emergency.
Anyways, people should think about these risks when dealing with 2FA: flood, fire, stolen, lost, (I) broke (Smartphone, yubikey, usb, etc), broke (itself), software bug, kids, washing machines, etc.
Re: Aegis Authenticator – Secure 2FA App for Android
#117I've been using FreeOTP+ for a while now, since it makes it easy to backup my tokens and has biometrics. I've given Aegis a spin, I think I will keep using it, for grouping/sorting alone. I have a ton of old keys that clutter things up.
Re: Aegis Authenticator – Secure 2FA App for Android
#118Earlier quoted context omitted.
It is also available on f-droid, and they compile the apps themselves instead of distributing compiled apps. So if you trust f-droid, you know it is the same as the open source code.
You need parties you trust auditing all the code and each change, before you run it.
F-Droid does check code before privacy violations for accepting it. Any potential privacy violations are labeled as "anti-features" and apps that don't meet F-Droid's inclusion criteria are rejected:
https://f-droid.org/docs/Inclusion_Policy/
Aegis Authenticator passed F-Droid's checks. It has no anti-features:
https://f-droid.org/en/packages/com.beemdevelopment.aegis/
Aegis doesn't even request the internet permission. Compare that with Authy, which logs users' IP addresses, login activity, phone numbers, and email addresses, and states that users' data and personal information will be shared with third parties for any reason Authy wants to:
https://www.twilio.com/legal/privacy/authy
Twilio has had 2 data breaches this year, and the second one involved Authy. Since Authy does not use end-to-end encryption, hackers were able to obtain 2FA credentials from any Authy account, and they compromised the accounts of 93 Authy users:
https://techcrunch.com/2022/08/26/twilio-breach-authy/
On top of that, Authy is closed source and its code has never been audited, not even by F-Droid. There is no way to use Authy without sending your personal information to a service that states it will not promise to keep it private.
There is no good reason to trust Authy over Aegis.
Re: Aegis Authenticator – Secure 2FA App for Android
#119Earlier quoted context omitted.
Authy has a questionable privacy policy: > When you use our app we collect: Your phone number, device information, and email address. > When you use an Authy token to log into an account, whether the token was generated on the app or one sent to you via your phone number, we collect and keep information associated with your login activity including information like your IP address, what application or program you log…
Unfortunately I didn't manage to set up Aegis with SendGrid, so I have to have Authy just for SendGrid (both belong to Twilio).
SendGrid does not support the TOTP standard (or any authenticator apps other than Authy), because as you mention, SendGrid and Authy are both owned by Twilio:
https://docs.sendgrid.com/ui/account-and-settings/two-factor...
For anyone shopping for an email provider, this would be one reason to choose a provider other than SendGrid.
Re: Aegis Authenticator – Secure 2FA App for Android
#120Earlier quoted context omitted.
Yubikeys store everything on the key. I can lose my phone and use your phone to see my 2FA codes. It's honestly one of the only way MFA make sense - otherwise you lock yourself out of your entire digital life when you lose your phone and need to rely on storing your backup codes (which opens up a storage security wormhole). It's also a lot easier to wear around your neck.
My Yubikey always loses its credentials. (If anyone else knows about it and have a fix I'm all ears.) I guess I need a new one, but what I want to say is don't rely on a single Yubikey or even two. Do have backups.
Which model do you own and how does the loss manifest?
The single-tap and long-tap don't produce expected output? Can you share more info on it?
I own many Yubikeys (due to research I've been doing in 2017.) and I had many Yubikeys to play with, for TOTP/HOTP/U2F purposes, even using it to unlock Windows and I haven't had a case of a Yubikey basically deprogram itself. I washed them in the washing machine, ran them over with my car, thew them in mud piles and they always worked without a fault so your case is a surprising one.
Judging by what you wrote, unless there's some weird NFC communication going on between your phone and Yubikey (are they in proximity?), I'd say it's faulty and you need a new one.