81–90 of 209 posts
People complaining about an "Authy jail" and yet I have no issues with Aegis. Which is also open source, available in the f-droid store, and been around for years.
Aegis, Bitwarden Authenticator, FreeOTP, and now Ente Auth. These are the best ones.
I feel like this misses the problem with Authy. There are hundreds, possibly thousands of 2FA alternatives for Authy. But when my 401K provider requires Authy to login in without providing a generic 2FA option, THAT is the problem.
THE problem with Authy in my humble opinion isn’t just that it’s an obnoxious proprietary app I shouldn’t need — it’s that it forces you to accept SMS as a get-out-of-security-free card. Being able to get a reset text to your registered number (and you MUST register a number, of course) unlocks all your OTPs for the attacker (who slipped some teenaged phone salesman $50 or a fake ID to swap your sims.) SMS is cancer…
I never understood why SMS are preferred to OTPs generated offline using credit cards and a card reader, which were fairly popular.
Actually, EU regulations state SMS should be phased out, but banks largely ignore that. SIM cloning is fairly easy...
Earlier quoted context omitted.
this is storing/syncing the shared secret used to generate the TOTP. generating the TOTP is fully offline.
Ok, except that the secret is the TOTP generator. Anyone that has the secret can generate any TOTP for any point in time, and own your 2FA. An attacker needs nothing else. So if the secrets are stored online - ever - it's nullifying the "offline" claim. Does anyone know a 2FA app that only stores secrets offline? Eg without any networking code; as it's not only not required, but IMO is required NOT to be there for it…
When I store my passwords and their 2FA secrets in my KeePass db, I’m arrogantly taking for granted that I won’t ever leak my whole secrets database, which is a risk I’m willing to take because I know what I’m doing (and don’t have any secrets valuable to state-level actors). I appreciate having the option to make this call so I don’t have to drop in to my email just to log into frigging Patreon.
Earlier quoted context omitted.
Thank you! Apps like Auth are a great fit for Flutter, where desktop support is nice to have. We're also using Flutter for our Photos[1] app, and it has served us well so far. Wherever necessary (cryptography, ML, transcoding, ...), we use a bridge to communicate with the native layer, and Flutter becomes a presentation layer of sorts. Reg. Gmail marking our verification emails going to spam, we aren't sure what the…
The migration guides dont work as of the hack as they all rely on desktop tools which used the api that script kiddies used to dump that list of 33m phone numbers. Any updated guides?
I'm currently unable to find a straight forward way of getting data out of Authy, will bump up this thread when I do.
I've been using Authy as a backup for 1Password (previously BitWarden/LastPass)'s 2FA since in a worst-case scenario I can get a replacement SIM card from my phone network's store and get back into my 1Password account via recovery. This has had to be tested once when my phone got pickpocketed in Amsterdam. Is there a better alternative? Authy is fine for this use, the rest of my 2FA tokens are in 1Password itself.
I've been using Authy as a backup for 1Password (previously BitWarden/LastPass)'s 2FA since in a worst-case scenario I can get a replacement SIM card from my phone network's store and get back into my 1Password account via recovery. This has had to be tested once when my phone got pickpocketed in Amsterdam. Is there a better alternative? Authy is fine for this use, the rest of my 2FA tokens are in 1Password itself.
If _I_ can get a replacement SIM card from your phone network's store, can I get into your 1Password account via recovery?
I guess there has to be a vulnerability _somewhere_ to make it possible to get back in again in an emergency.
What's the point of having your 2FA codes synchronized across all your devices? Isn't it in the name "TWO FACTOR"? It's supposed to be a separate device and ability to "across devices" comes as an anti-feature for me. 1) If you're not using password manager, then you're probably using same password everywhere, including your 2FA app. 2) If you're storing your 2FA codes in your password manager, then it's not really a…
It means you are providing two factors, not necessarily that you only have two factors. There are benefits to this. I've left my phone at work, and would have been SOL, except I have a tablet that never leaves my home which can also provide my second factor.
Earlier quoted context omitted.
And when Apple's automated systems disable your account you're locked out of your accounts.
Indeed, I don't understand why people's reactions to not liking and being trapped by a lock-in walled garden strategy (Authy) is to switch to another lock-in walled garden strategy (Apple).
How much stringency does a code/platform change get at Authy vs Apple? However, once you are in the Apple walls, they are just as ruthless at keeping you locked inside, which is why I try to minimize my dependencies where possible.
Earlier quoted context omitted.
If _I_ can get a replacement SIM card from your phone network's store, can I get into your 1Password account via recovery?
You'd need ID to get one. And you'd need the security key also. I guess there has to be a vulnerability _somewhere_ to make it possible to get back in again in an emergency.
Earlier quoted context omitted.
You'd need ID to get one. And you'd need the security key also. I guess there has to be a vulnerability _somewhere_ to make it possible to get back in again in an emergency.
ID can easily be social engineered. What is the security key?