Tangentially: I just got rid of Authy, it took me 2h to to migrate everything, moved to apple passwords (yea yea, still propriatary) which has a so far solid export feature. I will never forgive Authy/Twillio for deliberately making exports impossible.
Hey, would you mind sharing how you exported your codes out of Authy?
Ente Auth: open-source Authy alternative for 2FA
121–130 of 209 posts
Re: Ente Auth: open-source Authy alternative for 2FA
#122I feel like this misses the problem with Authy. There are hundreds, possibly thousands of 2FA alternatives for Authy. But when my 401K provider requires Authy to login in without providing a generic 2FA option, THAT is the problem.
If we're talking OTP/TOTP -- it's all the same. Even if a provider instructs you to use a specific app, e.g. Google or Authy, you can simply scan the QR code with whatever authenticator app you're using. All the QR code does is encode a URI containing the secret and issuer.
This is simply not true. Just today an app asked me to use Microsoft Authenticator, and scanning the QR code with Google Auth and Authy didn’t work, earning me an “Invalid QR code” error and forcing me to install the app from MS.
Re: Ente Auth: open-source Authy alternative for 2FA
#123Earlier quoted context omitted.
ID can easily be social engineered. What is the security key?
The secret key a random 34 character key[0]. You can also set up a security key[1] as 2FA, in which case you'd need both the secret key and security key. You need to know the user/email, password, the secret key (and security key if you've added one) to get into an account. 1Password cannot recover your account for you. On a family or company account you can set up trusted members that can recover your account for yo…
I see, thank you.
Re: Ente Auth: open-source Authy alternative for 2FA
#124Earlier quoted context omitted.
Regulators should mandate 2FA with an OTP standard, such as OATH TOTP. Here in EU, lots of banks use their own proprietary OTP-like standard or SMS. I never understood why SMS are preferred to OTPs generated offline using credit cards and a card reader, which were fairly popular. Actually, EU regulations state SMS should be phased out, but banks largely ignore that. SIM cloning is fairly easy...
The readers cost money and people lose them. I still have one for one bank but otherwise it's SMS everywhere. They clearly just don't see it as a realistic threat, on top of all the other security measures in place (for me it's a password, and also a memorable word that isn't typed on the keyboard, then SMS OTP). It's not a great defence of SMS but perfect is the enemy of good, and SMS is just about ok. Most hacking…
Passkeys.
Re: Ente Auth: open-source Authy alternative for 2FA
#125Earlier quoted context omitted.
If we're talking OTP/TOTP -- it's all the same. Even if a provider instructs you to use a specific app, e.g. Google or Authy, you can simply scan the QR code with whatever authenticator app you're using. All the QR code does is encode a URI containing the secret and issuer.
Authy supports TOTP, but also has its own proprietary TOTP-esque format that a bunch of sites & companies use (Twitch and my bank, among them) that can't be copied into another site. (Yes, it's bad, no, it shouldn't exist, no, I don't know why they don't just , etc.)
Twitch supports regular TOTP now, thank goodness.
Re: Ente Auth: open-source Authy alternative for 2FA
#126Earlier quoted context omitted.
I use Bitwarden for passwords, so... i dont really like that mucho having 2Fa there too... It losses the porpoise of the 2fa.
Bitwarden has a separate 2fa app so your totp codes aren't in the same password vault (though you can do that, but shouldn't).
Why shouldn't you?
I use a Yubikey as the 2FA for my bitwatden, then store all the TOTP codes with the passwords in the same vault. Quite convenient, and also adheres to the principles of MFA
Re: Ente Auth: open-source Authy alternative for 2FA
#127Somewhat related: I hope there will be more news coverage/attention on the whole Ravio situation. It totally seems like something that should be reported on. Raivo, marketed as open source, despite never being OSI-defined open source, created by a computer security professional & expert sold it (2fa app) to a shady & unknown guy from Morocco, who put people's codes behind a paywall. Crazy story. And we (probably) found out the guy behind it too.
Re: Ente Auth: open-source Authy alternative for 2FA
#128Earlier quoted context omitted.
Authy has this 7 digit TOTP, which seems kind of proprietary. But Aegis supports that too, and is open source.
Is it possible to 'transfer' the 7 digit account from Authy over or best to start over?
There used to be a roundabout (unsupported) way to export from Authy Desktop to another app but Authy discontinued the Desktop app and Windows at least won't let you launch it anymore.
I'm not aware of a way to export from the Authy phone app.
Re: Ente Auth: open-source Authy alternative for 2FA
#129I’ve had a really poor experience with the (open source) 2FA app Raivo on ios. Developer got bought out. Ads got added, and a bug was introduced where users lost 2fa backup. Losing 2fa access was not as bad as I expected since I stored 2fa backup codes in bitwarden notes. A lot of sites also feature email recovery. I ended up migrating totp 2fa to bitwarden and its been very convenient.
But how do you deal with the 2fa codes for bitwarden itself?
Re: Ente Auth: open-source Authy alternative for 2FA
#130Because I got fed up with all the existing 2FA apps (lack of backup, export, ...) I created a simple (desktop) CLI app which works for me: https://github.com/Dobatymo/otp-tool
It's just a one day project so far. But it has some nice features like taking a screenshot and reading qr codes from it and storing everything in a single enrypted file (which you can easily put on a cloud drive if you want to sync, otherwise it's completely offline)
It only supports the standard RFC 6238 TOTP so far.