Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ente Auth: open-source Authy alternative for 2FA

ente.io

Post reply on HN
Print view View original

51–60 of 209 posts

Re: Ente Auth: open-source Authy alternative for 2FA

#51

Post by vishnumohandas »

neoecos wrote: post #5

This looks good, as I wanted to "escape" the Authy jail (you cannot easly move out with your secrets), but moving a lot of 2fa's to a "new thing". How to make sure they are a good project?

Like a sibling comment mentioned, unlike Authy, you can easily export your data[1] from Ente.

Also, Ente is fully open-source[2]. If you wish, you can self-host the service and point the app your custom server[3].

[1]: https://help.ente.io/auth/migration-guides/export

[2]: https://github.com/ente-io/ente/

[3]: https://help.ente.io/self-hosting/guides/custom-server/

Re: Ente Auth: open-source Authy alternative for 2FA

#52

Post by freedomben »

NelsonMinar wrote: post #7
r0ckarong wrote: post #4

I'm very happy with Aegis.

Aegis is great but it's Android only. I really like their thoughtful export system. Ente has export as well, I wonder how it compares.

> Aegis is great but it's Android only.

Yes true, but the Aegis format is supported on Linux by Gnome Authenticator: https://apps.gnome.org/en/Authenticator/

Re: Ente Auth: open-source Authy alternative for 2FA

#53

Post by vishnumohandas »

robxorb wrote: post #43
mcpeepants wrote: post #24

Earlier quoted context omitted.

this is storing/syncing the shared secret used to generate the TOTP. generating the TOTP is fully offline.

Ok, except that the secret is the TOTP generator. Anyone that has the secret can generate any TOTP for any point in time, and own your 2FA. An attacker needs nothing else. So if the secrets are stored online - ever - it's nullifying the "offline" claim. Does anyone know a 2FA app that only stores secrets offline? Eg without any networking code; as it's not only not required, but IMO is required NOT to be there for it…

> Does anyone know a 2FA app that only stores secrets offline?

Ente Auth works fully offline. E2EE backups are optional.

Re: Ente Auth: open-source Authy alternative for 2FA

#54

Post by freedomben »

andrewinardeer wrote: post #44
andrewmcwatters wrote: post #40

I don't see people mention this enough, but iCloud Keychain generates TOTPs. I've been migrating all of my accounts slowly to just use the built-in Apple Passwords functionality. In Safari, right click on TOTP QR codes.

And when Apple's automated systems disable your account you're locked out of your accounts.

Indeed, I don't understand why people's reactions to not liking and being trapped by a lock-in walled garden strategy (Authy) is to switch to another lock-in walled garden strategy (Apple).

Re: Ente Auth: open-source Authy alternative for 2FA

#55

Post by jamesralph8555 »

I’ve had a really poor experience with the (open source) 2FA app Raivo on ios. Developer got bought out. Ads got added, and a bug was introduced where users lost 2fa backup. Losing 2fa access was not as bad as I expected since I stored 2fa backup codes in bitwarden notes. A lot of sites also feature email recovery. I ended up migrating totp 2fa to bitwarden and its been very convenient.

Re: Ente Auth: open-source Authy alternative for 2FA

#56

Post by chillydawg »

vishnumohandas wrote: post #45
nicpottier wrote: post #29

This looks quite nice, thank you for releasing it open source. Also neat to see a real Flutter app in the wild, this seems like a great use case for it. Would love to read your experience building something polished across ios/android on Flutter. One note as I signed up for an account is that the email verification went to gmails spam. Probably nothing to be done about that but mentioning it. I would also add an "aut…

Thank you! Apps like Auth are a great fit for Flutter, where desktop support is nice to have. We're also using Flutter for our Photos[1] app, and it has served us well so far. Wherever necessary (cryptography, ML, transcoding, ...), we use a bridge to communicate with the native layer, and Flutter becomes a presentation layer of sorts. Reg. Gmail marking our verification emails going to spam, we aren't sure what the…

The migration guides dont work as of the hack as they all rely on desktop tools which used the api that script kiddies used to dump that list of 33m phone numbers. Any updated guides?

Re: Ente Auth: open-source Authy alternative for 2FA

#57

Post by RockRobotRock »

ezekg wrote: post #50
secstate wrote: post #28

I feel like this misses the problem with Authy. There are hundreds, possibly thousands of 2FA alternatives for Authy. But when my 401K provider requires Authy to login in without providing a generic 2FA option, THAT is the problem.

If we're talking OTP/TOTP -- it's all the same. Even if a provider instructs you to use a specific app, e.g. Google or Authy, you can simply scan the QR code with whatever authenticator app you're using. All the QR code does is encode a URI containing the secret and issuer.

I don’t think that’s what they’re saying. Authy supports TOTP but they also have a proprietary format.

Re: Ente Auth: open-source Authy alternative for 2FA

#58

Post by ackyshake »

Last week, I started to explore `pass`[1], to move away from my current Authy + iCloud Keychain ecosystems. It's pretty barebones but that's what I like about it. I like it so much that one week later, I've fully migrated away and couldn't be happier.

And the news about the Authy leak yesterday validated my move, if anything.

I don't really care for ente; it's more complicated than what I need from a password manager. And the fact that pass is so much more customizable (being as it's only 700 or so lines of shell script), I don't feel like I need anything more _personally_.

[1]: https://www.passwordstore.org/

Re: Ente Auth: open-source Authy alternative for 2FA

#59

Post by roughly »

ezekg wrote: post #50
secstate wrote: post #28

I feel like this misses the problem with Authy. There are hundreds, possibly thousands of 2FA alternatives for Authy. But when my 401K provider requires Authy to login in without providing a generic 2FA option, THAT is the problem.

If we're talking OTP/TOTP -- it's all the same. Even if a provider instructs you to use a specific app, e.g. Google or Authy, you can simply scan the QR code with whatever authenticator app you're using. All the QR code does is encode a URI containing the secret and issuer.

Authy supports TOTP, but also has its own proprietary TOTP-esque format that a bunch of sites & companies use (Twitch and my bank, among them) that can't be copied into another site.

(Yes, it's bad, no, it shouldn't exist, no, I don't know why they don't just , etc.)

Re: Ente Auth: open-source Authy alternative for 2FA

#60

Post by roughly »

croes wrote: post #33
andrei-akopian wrote: post #16

Earlier quoted context omitted.

Am I misunderstanding your comment or do you think that Authy is the same as Aegis? Anyway, Aegis and Ente have export options, Aughy doesn't.

More like, why do they complain if alternatives exist.

Authy supports normal TOTP but also has its own proprietary TOTP format for which alternatives do not exist.
Post reply on HN