Ente Auth: open-source Authy alternative for 2FA

Post by ezekg » Sat, Jul 06, 2024, 2:49 AM UTC

omneity wrote: post #122

ezekg wrote: post #50

Earlier quoted context omitted.

If we're talking OTP/TOTP -- it's all the same. Even if a provider instructs you to use a specific app, e.g. Google or Authy, you can simply scan the QR code with whatever authenticator app you're using. All the QR code does is encode a URI containing the secret and issuer.

This is simply not true. Just today an app asked me to use Microsoft Authenticator, and scanning the QR code with Google Auth and Authy didn’t work, earning me an “Invalid QR code” error and forcing me to install the app from MS.

Post by nextos » Sat, Jul 06, 2024, 3:50 AM UTC

kevincox wrote: post #137

etskinner wrote: post #131

Earlier quoted context omitted.

The reason that SMS is preferred is that "everyone has it". Requiring all customers to get an app is much harder than requiring them to have a phone number than can receive SMS

"everyone has it" and it is "good enough" at preventing large scale attacks like credential stuffing from data breaches. Most online services aren't so worried about a small number of users being SIM-swapped. They are worried about large numbers of users that reused their password across thousands of sites 5 of which had their database dumped. SMS 2FA isn't about providing individual users a high level of security. I…

Post by SSchick » Sat, Jul 06, 2024, 4:28 AM UTC

vishnumohandas wrote: post #98

SSchick wrote: post #97

Tangentially: I just got rid of Authy, it took me 2h to to migrate everything, moved to apple passwords (yea yea, still propriatary) which has a so far solid export feature. I will never forgive Authy/Twillio for deliberately making exports impossible.

Hey, would you mind sharing how you exported your codes out of Authy?

Post by snailmailman » Sat, Jul 06, 2024, 5:03 AM UTC

ecesena wrote: post #133

vishnumohandas wrote: post #106

Earlier quoted context omitted.

We have intentionally opted out of this[1][2] for now, since we did not want to create a dependency on iCloud for backups. So if you purchase a new device, you will either have to sign in to Ente Auth again (for E2EE sync), or export your codes from the older device, and import it to the newer device. [1]: https://github.com/ente-io/ente/blob/8b696b1242bce2f166ddd6a... [2]: https://github.com/mogol/flutter_secure_sto…

Thank you. FWIW, my need comes primarily from non-technical/inexperienced users. I can't tell my parents/many friends to remember to "sign into all these apps" as soon as they get a new phone, or they loose access to banks & co. Regardless I appreciate that at least you made a conscious decision.

Post by t0bia_s » Sat, Jul 06, 2024, 5:59 AM UTC

nextos wrote: post #82

xp84 wrote: post #76

Earlier quoted context omitted.

THE problem with Authy in my humble opinion isn’t just that it’s an obnoxious proprietary app I shouldn’t need — it’s that it forces you to accept SMS as a get-out-of-security-free card. Being able to get a reset text to your registered number (and you MUST register a number, of course) unlocks all your OTPs for the attacker (who slipped some teenaged phone salesman $50 or a fake ID to swap your sims.) SMS is cancer…

Regulators should mandate 2FA with an OTP standard, such as OATH TOTP. Here in EU, lots of banks use their own proprietary OTP-like standard or SMS. I never understood why SMS are preferred to OTPs generated offline using credit cards and a card reader, which were fairly popular. Actually, EU regulations state SMS should be phased out, but banks largely ignore that. SIM cloning is fairly easy...