Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ente Auth: open-source Authy alternative for 2FA

ente.io

Post reply on HN
Print view View original

111–120 of 209 posts

Re: Ente Auth: open-source Authy alternative for 2FA

#111

Post by QasimK »

vishnumohandas wrote: post #45
nicpottier wrote: post #29

This looks quite nice, thank you for releasing it open source. Also neat to see a real Flutter app in the wild, this seems like a great use case for it. Would love to read your experience building something polished across ios/android on Flutter. One note as I signed up for an account is that the email verification went to gmails spam. Probably nothing to be done about that but mentioning it. I would also add an "aut…

Thank you! Apps like Auth are a great fit for Flutter, where desktop support is nice to have. We're also using Flutter for our Photos[1] app, and it has served us well so far. Wherever necessary (cryptography, ML, transcoding, ...), we use a bridge to communicate with the native layer, and Flutter becomes a presentation layer of sorts. Reg. Gmail marking our verification emails going to spam, we aren't sure what the…

Ah, so _that’s_ why the ente photos app feels so “off” - it’s using flutter.

I’ve tried the app a few times over the last couple of years and had a dislike of the UI because it did not _feel_ right, like it was slow or something. I can’t say exactly what.

It is almost certainly because it is using flutter rather than native DOM elements.

(I’ve been keeping track of ente but never quite made the jump - not solely due to the UI though!)

Re: Ente Auth: open-source Authy alternative for 2FA

#112

Post by wesapien »

secstate wrote: post #28

I feel like this misses the problem with Authy. There are hundreds, possibly thousands of 2FA alternatives for Authy. But when my 401K provider requires Authy to login in without providing a generic 2FA option, THAT is the problem.

Is there a list of services that have a specific 2FA provider requirement? In my experience, my when my service ask for 2FA it usually says Google Authenticator and use Authy. I'm looking to migrate out of Authy in the near future.

Re: Ente Auth: open-source Authy alternative for 2FA

#113

Post by rpgbr »

neoecos wrote: post #81
uyzstvqs wrote: post #22

Earlier quoted context omitted.

Aegis, Bitwarden Authenticator, FreeOTP, and now Ente Auth. These are the best ones.

I use Bitwarden for passwords, so... i dont really like that mucho having 2Fa there too... It losses the porpoise of the 2fa.

Not really? Even in the same basket, having TOTP and passwords on iCloud mitigates a lot of scenarios, such as leaked passwords.

Depending on your threat model, this solution is ok — way better than no 2FA at all or SMS.

1Password has a nice article regarding this point: https://blog.1password.com/1password-2fa-passwords-codes-tog...

Re: Ente Auth: open-source Authy alternative for 2FA

#114

Post by nextos »

benoliver999 wrote: post #103
nextos wrote: post #82

Earlier quoted context omitted.

Regulators should mandate 2FA with an OTP standard, such as OATH TOTP. Here in EU, lots of banks use their own proprietary OTP-like standard or SMS. I never understood why SMS are preferred to OTPs generated offline using credit cards and a card reader, which were fairly popular. Actually, EU regulations state SMS should be phased out, but banks largely ignore that. SIM cloning is fairly easy...

The readers cost money and people lose them. I still have one for one bank but otherwise it's SMS everywhere. They clearly just don't see it as a realistic threat, on top of all the other security measures in place (for me it's a password, and also a memorable word that isn't typed on the keyboard, then SMS OTP). It's not a great defence of SMS but perfect is the enemy of good, and SMS is just about ok. Most hacking…

At least here, SIM cloning is a very popular attack.

Re: Ente Auth: open-source Authy alternative for 2FA

#115

Post by okkdev »

r0ckarong wrote: post #4

I'm very happy with Aegis.

Me too, but it had this nasty bug where me and a bunch of other users occasionally only saw a black screen after unlocking. For me rebooting my phone fixed it, but not for everyone. I can't really afford to not be able to access my 2fa codes. This lasted for over a month, so I decided to move to ente auth.

Re: Ente Auth: open-source Authy alternative for 2FA

#116

Post by kuon »

roughly wrote: post #59
ezekg wrote: post #50

Earlier quoted context omitted.

If we're talking OTP/TOTP -- it's all the same. Even if a provider instructs you to use a specific app, e.g. Google or Authy, you can simply scan the QR code with whatever authenticator app you're using. All the QR code does is encode a URI containing the secret and issuer.

Authy supports TOTP, but also has its own proprietary TOTP-esque format that a bunch of sites & companies use (Twitch and my bank, among them) that can't be copied into another site. (Yes, it's bad, no, it shouldn't exist, no, I don't know why they don't just , etc.)

I use keepassxc for twitch so it should be something fairly standard, I don't remember using special settings.

Anyway, I wanted to share this gist which might be of some help to migrate away from authy:

https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d...

Re: Ente Auth: open-source Authy alternative for 2FA

#117

Post by ancientworldnow »

neoecos wrote: post #81
uyzstvqs wrote: post #22

Earlier quoted context omitted.

Aegis, Bitwarden Authenticator, FreeOTP, and now Ente Auth. These are the best ones.

I use Bitwarden for passwords, so... i dont really like that mucho having 2Fa there too... It losses the porpoise of the 2fa.

Bitwarden has a separate 2fa app so your totp codes aren't in the same password vault (though you can do that, but shouldn't).

Re: Ente Auth: open-source Authy alternative for 2FA

#118

Post by arrakeenrevived »

xp84 wrote: post #76
secstate wrote: post #28

I feel like this misses the problem with Authy. There are hundreds, possibly thousands of 2FA alternatives for Authy. But when my 401K provider requires Authy to login in without providing a generic 2FA option, THAT is the problem.

THE problem with Authy in my humble opinion isn’t just that it’s an obnoxious proprietary app I shouldn’t need — it’s that it forces you to accept SMS as a get-out-of-security-free card. Being able to get a reset text to your registered number (and you MUST register a number, of course) unlocks all your OTPs for the attacker (who slipped some teenaged phone salesman $50 or a fake ID to swap your sims.) SMS is cancer…

Decrypting the OTPs on another device has required a password for a long time now (maybe always, I can't actually remember if it was always there or just added years ago). It isn't only bound to your phone number.

Re: Ente Auth: open-source Authy alternative for 2FA

#119

Post by SparkyMcUnicorn »

dotancohen wrote: post #89
benbristow wrote: post #86

Earlier quoted context omitted.

You'd need ID to get one. And you'd need the security key also. I guess there has to be a vulnerability _somewhere_ to make it possible to get back in again in an emergency.

ID can easily be social engineered. What is the security key?

The secret key a random 34 character key[0].

You can also set up a security key[1] as 2FA, in which case you'd need both the secret key and security key.

You need to know the user/email, password, the secret key (and security key if you've added one) to get into an account. 1Password cannot recover your account for you. On a family or company account you can set up trusted members that can recover your account for you, but if everyone loses their credentials all at once then you're locked out forever and need to start over with new vaults.

[0] https://support.1password.com/secret-key-security/

[1] https://support.1password.com/security-key/

Re: Ente Auth: open-source Authy alternative for 2FA

#120

Post by dvzk »

andrewinardeer wrote: post #44
andrewmcwatters wrote: post #40

I don't see people mention this enough, but iCloud Keychain generates TOTPs. I've been migrating all of my accounts slowly to just use the built-in Apple Passwords functionality. In Safari, right click on TOTP QR codes.

And when Apple's automated systems disable your account you're locked out of your accounts.

If a single remote service can lock you out of your 2FA accounts then you failed with your backup policy. I don't use it, but Apple Passwords makes TOTP secret backups possible, via bulk export and initial key setup.
Post reply on HN