41–50 of 209 posts
My hunt for an open source Authy took me to 2FAS, which has been fine. Any opinions on this offering? 2FAS — the Internet’s favorite open-source two-factor authenticator https://2fas.com
Do any of the many TOTP options have the ability to organize, or put codes into vaults? One you have more than a couple of dozen saved, it starts to get tedious.
Earlier quoted context omitted.
> 2FAS syncs across your mobile devices. [...] > 2FAS works offline. > 2FAS doesn't store any passwords or metadata. Eh?
this is storing/syncing the shared secret used to generate the TOTP. generating the TOTP is fully offline.
Does anyone know a 2FA app that only stores secrets offline? Eg without any networking code; as it's not only not required, but IMO is required NOT to be there for it to actually functionally be "two-factor authentication", and therefore locally-isolated.
iCloud is the worst choice of a place to store them as it's the same place the other factor may be routinely saved / backed-up, especially if "across devices".
I don't see people mention this enough, but iCloud Keychain generates TOTPs. I've been migrating all of my accounts slowly to just use the built-in Apple Passwords functionality. In Safari, right click on TOTP QR codes.
This looks quite nice, thank you for releasing it open source. Also neat to see a real Flutter app in the wild, this seems like a great use case for it. Would love to read your experience building something polished across ios/android on Flutter. One note as I signed up for an account is that the email verification went to gmails spam. Probably nothing to be done about that but mentioning it. I would also add an "aut…
Apps like Auth are a great fit for Flutter, where desktop support is nice to have. We're also using Flutter for our Photos[1] app, and it has served us well so far. Wherever necessary (cryptography, ML, transcoding, ...), we use a bridge to communicate with the native layer, and Flutter becomes a presentation layer of sorts.
Reg. Gmail marking our verification emails going to spam, we aren't sure what the issue is. We migrated from Zoho to SES recently hoping to fix this, but that has not helped. If anyone here understands email deliverability, please do share your thoughts, we'd be grateful!
We've a migration guide from Authy here[2]. They make it difficult, but it's possible.
[1]: https://ente.io
I've been using Authy as a backup for 1Password (previously BitWarden/LastPass)'s 2FA since in a worst-case scenario I can get a replacement SIM card from my phone network's store and get back into my 1Password account via recovery. This has had to be tested once when my phone got pickpocketed in Amsterdam. Is there a better alternative? Authy is fine for this use, the rest of my 2FA tokens are in 1Password itself.
If you’re on a Mac and use Safari, it has a neat 2FA integration built in, which saves and autofills OTPs from iCloud Keychain.
Earlier quoted context omitted.
Am I misunderstanding your comment or do you think that Authy is the same as Aegis? Anyway, Aegis and Ente have export options, Aughy doesn't.
More like, why do they complain if alternatives exist.
It is a pain to switch over; but that is the way it is with all sorts of proprietary programs. They just tighten the noose regardless if you pay or not.
What's the point of having your 2FA codes synchronized across all your devices? Isn't it in the name "TWO FACTOR"? It's supposed to be a separate device and ability to "across devices" comes as an anti-feature for me. 1) If you're not using password manager, then you're probably using same password everywhere, including your 2FA app. 2) If you're storing your 2FA codes in your password manager, then it's not really a…
Having it integrated with a password manager is less secure than having it as a separate app in a separate device, but it makes it so much easier for the average person that they're more likely to actually use it.
In a vacuum, yes, you're right. It's not as secure this way. I wouldn't use that for something hyper-sensitive like classified systems. But as a system, "less secure but widely used" beats "more secure but most people avoid using it whenever possible".
It's like with the NIST recommendation against regularly rotating passwords. In an ideal world, it's a great ideal to require new passwords frequently. In this world, it only makes people pick bad passwords and append the date or serial number to it. As a system, it's more secure to require strong passwords and then leave them alone until/unless you suspect they've been compromised.
I feel like this misses the problem with Authy. There are hundreds, possibly thousands of 2FA alternatives for Authy. But when my 401K provider requires Authy to login in without providing a generic 2FA option, THAT is the problem.