Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ente Auth: open-source Authy alternative for 2FA

ente.io

Post reply on HN
Print view View original

101–110 of 209 posts

Re: Ente Auth: open-source Authy alternative for 2FA

#101

Post by andrei-akopian »

neoecos wrote: post #77
andrei-akopian wrote: post #14

Earlier quoted context omitted.

You can't but they should be better than Authy, at least they have export options...

I was hoping for allow importing Authy secrets, has anyone sucessfully "taken" the backup out of the app and imported in other tool. As security measure the secrets only live in Authy, but thats when I cannot move out when I want.

Ente has an Authy export guide. https://help.ente.io/auth/migration-guides/authy/

You don't even need to have Authy installed. The script pretends to be a new device and gets the keys from your backup. (You might need to run chmod +x for execute permission)

Re: Ente Auth: open-source Authy alternative for 2FA

#102

Post by out-of-ideas »

vishnumohandas wrote: post #100
out-of-ideas wrote: post #99

Earlier quoted context omitted.

sounds more simple than Ente's Auth; for instance I can see having a simple totp record-keeping app on an internet-less rpi or similar (or highly restricted networking where an auth'd user can only webui interface with some backup/restore feature when blue-green'ing the device), integrated with some built in (touch)?screen to select/search service-account to read totp from and adding-new via screen as well. edit: sim…

fwiw, Ente's Auth works fully offline. E2EE backups / account creation is optional. If you have an RPi that is accessible over a network, you could self host it as well: https://help.ente.io/self-hosting/

yep i did check all that; i however did not check Owky and only now realize it is an apple app; i was implying dont giveup on simple-apps just because another has similar features - sometimes simple things can have huge benifits (all subjective though)

Re: Ente Auth: open-source Authy alternative for 2FA

#103

Post by benoliver999 »

nextos wrote: post #82
xp84 wrote: post #76

Earlier quoted context omitted.

THE problem with Authy in my humble opinion isn’t just that it’s an obnoxious proprietary app I shouldn’t need — it’s that it forces you to accept SMS as a get-out-of-security-free card. Being able to get a reset text to your registered number (and you MUST register a number, of course) unlocks all your OTPs for the attacker (who slipped some teenaged phone salesman $50 or a fake ID to swap your sims.) SMS is cancer…

Regulators should mandate 2FA with an OTP standard, such as OATH TOTP. Here in EU, lots of banks use their own proprietary OTP-like standard or SMS. I never understood why SMS are preferred to OTPs generated offline using credit cards and a card reader, which were fairly popular. Actually, EU regulations state SMS should be phased out, but banks largely ignore that. SIM cloning is fairly easy...

The readers cost money and people lose them. I still have one for one bank but otherwise it's SMS everywhere.

They clearly just don't see it as a realistic threat, on top of all the other security measures in place (for me it's a password, and also a memorable word that isn't typed on the keyboard, then SMS OTP). It's not a great defence of SMS but perfect is the enemy of good, and SMS is just about ok.

Most hacking stories I hear about seem to happen through social engineering, where people go to great lengths to authenticate themselves for someone over the phone.

One thing that is starting to take hold is banking apps, which once installed can be used to authenticate payment. Again not perfect but better than SMS, and users are increasingly likely to have them installed because of ease of use.

Re: Ente Auth: open-source Authy alternative for 2FA

#104

Post by ecesena »

vishnumohandas wrote: post #66

Hello, one of the folks working on Ente Auth here. Thanks for putting us on the frontpage! To give some context, we built Auth for ourselves because we wanted a product that was cross-platform, open source[1] and offered end-to-end encrypted backups[2]. Since launch[3], the product has undergone iterations[4][5]. Auth is now available on Android, iOS, Linux, Mac and Windows[6]. We also have a read-only companion app…

Out of curiosity, have you tested what happens if you buy a new iPhone and upgrade from old to new one? (Preferably no backup, just the new/standard upgrade procedure where you bring the new device close to the old one, and Apple does its magic.)

The only reason why I use (and recommend) Authy is that when I get a new phone it just works, while other apps require to somehow open them and do some operation between old and new phone.

If it works, happy to switch to an open alternative! (Asking about iPhone, but I assume Android folks would also be interested.)

Re: Ente Auth: open-source Authy alternative for 2FA

#105

Post by radicality »

ecesena wrote: post #104
vishnumohandas wrote: post #66

Hello, one of the folks working on Ente Auth here. Thanks for putting us on the frontpage! To give some context, we built Auth for ourselves because we wanted a product that was cross-platform, open source[1] and offered end-to-end encrypted backups[2]. Since launch[3], the product has undergone iterations[4][5]. Auth is now available on Android, iOS, Linux, Mac and Windows[6]. We also have a read-only companion app…

Out of curiosity, have you tested what happens if you buy a new iPhone and upgrade from old to new one? (Preferably no backup, just the new/standard upgrade procedure where you bring the new device close to the old one, and Apple does its magic.) The only reason why I use (and recommend) Authy is that when I get a new phone it just works, while other apps require to somehow open them and do some operation between old…

If you’re in the Apple/iOS ecosystem and want the syncing to happen via iCloud, you might as well use Apple’s built-in password manager which has support for 2FA codes.

Re: Ente Auth: open-source Authy alternative for 2FA

#106

Post by vishnumohandas »

ecesena wrote: post #104
vishnumohandas wrote: post #66

Hello, one of the folks working on Ente Auth here. Thanks for putting us on the frontpage! To give some context, we built Auth for ourselves because we wanted a product that was cross-platform, open source[1] and offered end-to-end encrypted backups[2]. Since launch[3], the product has undergone iterations[4][5]. Auth is now available on Android, iOS, Linux, Mac and Windows[6]. We also have a read-only companion app…

Out of curiosity, have you tested what happens if you buy a new iPhone and upgrade from old to new one? (Preferably no backup, just the new/standard upgrade procedure where you bring the new device close to the old one, and Apple does its magic.) The only reason why I use (and recommend) Authy is that when I get a new phone it just works, while other apps require to somehow open them and do some operation between old…

We have intentionally opted out of this[1][2] for now, since we did not want to create a dependency on iCloud for backups.

So if you purchase a new device, you will either have to sign in to Ente Auth again (for E2EE sync), or export your codes from the older device, and import it to the newer device.

[1]: https://github.com/ente-io/ente/blob/8b696b1242bce2f166ddd6a...

[2]: https://github.com/mogol/flutter_secure_storage/blob/cb30953...

Re: Ente Auth: open-source Authy alternative for 2FA

#107

Post by vishnumohandas »

out-of-ideas wrote: post #102
vishnumohandas wrote: post #100

Earlier quoted context omitted.

fwiw, Ente's Auth works fully offline. E2EE backups / account creation is optional. If you have an RPi that is accessible over a network, you could self host it as well: https://help.ente.io/self-hosting/

yep i did check all that; i however did not check Owky and only now realize it is an apple app; i was implying dont giveup on simple-apps just because another has similar features - sometimes simple things can have huge benifits (all subjective though)

Understood :)

Re: Ente Auth: open-source Authy alternative for 2FA

#108

Post by birdman3131 »

radicality wrote: post #105
ecesena wrote: post #104

Earlier quoted context omitted.

Out of curiosity, have you tested what happens if you buy a new iPhone and upgrade from old to new one? (Preferably no backup, just the new/standard upgrade procedure where you bring the new device close to the old one, and Apple does its magic.) The only reason why I use (and recommend) Authy is that when I get a new phone it just works, while other apps require to somehow open them and do some operation between old…

If you’re in the Apple/iOS ecosystem and want the syncing to happen via iCloud, you might as well use Apple’s built-in password manager which has support for 2FA codes.

Just because your in the Apple ecosystem does not mean your not outside it as well and want the crossplatform side.

Re: Ente Auth: open-source Authy alternative for 2FA

#109

Post by AdamJacobMuller »

birdman3131 wrote: post #108
radicality wrote: post #105

Earlier quoted context omitted.

If you’re in the Apple/iOS ecosystem and want the syncing to happen via iCloud, you might as well use Apple’s built-in password manager which has support for 2FA codes.

Just because your in the Apple ecosystem does not mean your not outside it as well and want the crossplatform side.

Exactly. I use BitWarden for this reason.

Re: Ente Auth: open-source Authy alternative for 2FA

#110

Post by 77pt77 »

roughly wrote: post #59
ezekg wrote: post #50

Earlier quoted context omitted.

If we're talking OTP/TOTP -- it's all the same. Even if a provider instructs you to use a specific app, e.g. Google or Authy, you can simply scan the QR code with whatever authenticator app you're using. All the QR code does is encode a URI containing the secret and issuer.

Authy supports TOTP, but also has its own proprietary TOTP-esque format that a bunch of sites & companies use (Twitch and my bank, among them) that can't be copied into another site. (Yes, it's bad, no, it shouldn't exist, no, I don't know why they don't just , etc.)

Is it standardized?
Post reply on HN