Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ente Auth: open-source Authy alternative for 2FA

ente.io

Post reply on HN
Print view View original

161–170 of 209 posts

Re: Ente Auth: open-source Authy alternative for 2FA

#161

Post by ravjo »

vishnumohandas wrote: post #45
nicpottier wrote: post #29

This looks quite nice, thank you for releasing it open source. Also neat to see a real Flutter app in the wild, this seems like a great use case for it. Would love to read your experience building something polished across ios/android on Flutter. One note as I signed up for an account is that the email verification went to gmails spam. Probably nothing to be done about that but mentioning it. I would also add an "aut…

Thank you! Apps like Auth are a great fit for Flutter, where desktop support is nice to have. We're also using Flutter for our Photos[1] app, and it has served us well so far. Wherever necessary (cryptography, ML, transcoding, ...), we use a bridge to communicate with the native layer, and Flutter becomes a presentation layer of sorts. Reg. Gmail marking our verification emails going to spam, we aren't sure what the…

Reg. Gmail marking Ente verification emails as spam and showing the "Similar messages were used to steal people's personal information" warning.

Not an engineer/experienced with email deliverability, but, I _did_ feel something off when I received the Email verification code email (which too was marked as spam by Gmail). Thoughts/observations:

1. The email body is very minimal, which could be a good thing, but, > it did not have the usual trust markers/indicators - no brand logo or name at the top, > a generic envelope/letter icon/image as the largest visual item in the message > just a single "Use this code to verify your email address" line in the message body (except the "ente.io" link at the footer)

2. I did a quick comparison between the Ente verification code emails and some recent verification code emails from other products (Backblaze, Google, Instagram, IBM Security..) > none of them were as barebones/non-descript like the Ente emails. > They had descriptive text that provided a bit of context ("you recently signed up for an account at XYZ with PQR email address, and this code is required to...") > They had the brand identity (Name / Logo) prominently somewhere in the beginning of the message > AND most of them had the company name, registered address, and contact details in the footer. (Adds accountbility/trust?). Some even had links to privacy and support pages.

3. I believe you must have already explored the BIMI, VMC route for the "gmail blue tick".

Re: Ente Auth: open-source Authy alternative for 2FA

#162

Post by fmajid »

jpalomaki wrote: post #156
nextos wrote: post #82

Earlier quoted context omitted.

Regulators should mandate 2FA with an OTP standard, such as OATH TOTP. Here in EU, lots of banks use their own proprietary OTP-like standard or SMS. I never understood why SMS are preferred to OTPs generated offline using credit cards and a card reader, which were fairly popular. Actually, EU regulations state SMS should be phased out, but banks largely ignore that. SIM cloning is fairly easy...

The main problem with secure device based 2FA is how to handle the case when device gets lost and you don't have backups (many people don't really think this kind of stuff beforehand). How can a person re-establish their identity? For services like Google, Facebook etc. the answer might be "you don't", but it is more difficult for companies where the end user is also the customer. And I think the best answer is gover…

That's why Apple forces you to register two FIDO U2F keys if you use that option for iCloud.

Re: Ente Auth: open-source Authy alternative for 2FA

#163

Post by Kwpolska »

jerrygoyal wrote: post #154
xp84 wrote: post #76

Earlier quoted context omitted.

THE problem with Authy in my humble opinion isn’t just that it’s an obnoxious proprietary app I shouldn’t need — it’s that it forces you to accept SMS as a get-out-of-security-free card. Being able to get a reset text to your registered number (and you MUST register a number, of course) unlocks all your OTPs for the attacker (who slipped some teenaged phone salesman $50 or a fake ID to swap your sims.) SMS is cancer…

curious, why SMS is insecure? It's not like a hacker can simply clone your sim.

A hacker can perform a SIM swap attack, where they convince the operator using bribes and/or fake IDs to provide a replacement SIM card for your number.

Re: Ente Auth: open-source Authy alternative for 2FA

#164

Post by vishnumohandas »

ravjo wrote: post #161
vishnumohandas wrote: post #45

Earlier quoted context omitted.

Thank you! Apps like Auth are a great fit for Flutter, where desktop support is nice to have. We're also using Flutter for our Photos[1] app, and it has served us well so far. Wherever necessary (cryptography, ML, transcoding, ...), we use a bridge to communicate with the native layer, and Flutter becomes a presentation layer of sorts. Reg. Gmail marking our verification emails going to spam, we aren't sure what the…

Reg. Gmail marking Ente verification emails as spam and showing the "Similar messages were used to steal people's personal information" warning. Not an engineer/experienced with email deliverability, but, I _did_ feel something off when I received the Email verification code email (which too was marked as spam by Gmail). Thoughts/observations: 1. The email body is very minimal, which could be a good thing, but, > it…

Thanks for sharing these!

BIMI + VMC seems like an expensive workaround, we'll first experiment with your first two recommendations. We'll also have to figure out a way to reset the score with Gmail. Hopefully they haven't penalized the whole domain, and a new from-address will do it.

Thanks again for taking the time out to share your thoughts, really appreciate it! :)

Re: Ente Auth: open-source Authy alternative for 2FA

#165

Post by jerrygoyal »

Kwpolska wrote: post #163
jerrygoyal wrote: post #154

Earlier quoted context omitted.

curious, why SMS is insecure? It's not like a hacker can simply clone your sim.

A hacker can perform a SIM swap attack, where they convince the operator using bribes and/or fake IDs to provide a replacement SIM card for your number.

what's the better alternative?

Re: Ente Auth: open-source Authy alternative for 2FA

#166

Post by anssip »

I've developed a command-line password manager and authentication application in Rust. Here are the key features:

1. Uses KeePass file format for secure credential storage 2. Supports One-Time Passwords (OTP) for two-factor authentication (2FA) 3. Provides a convenient CLI interface for retrieving 2FA codes

The project, named Passlane, offers a streamlined approach to password management directly from the terminal. It's particularly satisfying to generate 2FA codes via command line!

For those interested in exploring the code or contributing, you can find the project on GitHub: https://github.com/anssip/passlane

I'd appreciate any feedback or suggestions for improvement.

Re: Ente Auth: open-source Authy alternative for 2FA

#167

Post by nickburns »

omneity wrote: post #122
ezekg wrote: post #50

Earlier quoted context omitted.

If we're talking OTP/TOTP -- it's all the same. Even if a provider instructs you to use a specific app, e.g. Google or Authy, you can simply scan the QR code with whatever authenticator app you're using. All the QR code does is encode a URI containing the secret and issuer.

This is simply not true. Just today an app asked me to use Microsoft Authenticator, and scanning the QR code with Google Auth and Authy didn’t work, earning me an “Invalid QR code” error and forcing me to install the app from MS.

You assume that because you were not able to overcome whatever error/s you encountered with Google Auth and Authy, that you were being forced to use MS Authenticator.

Re: Ente Auth: open-source Authy alternative for 2FA

#168

Post by jeroenhd »

jerrygoyal wrote: post #154
xp84 wrote: post #76

Earlier quoted context omitted.

THE problem with Authy in my humble opinion isn’t just that it’s an obnoxious proprietary app I shouldn’t need — it’s that it forces you to accept SMS as a get-out-of-security-free card. Being able to get a reset text to your registered number (and you MUST register a number, of course) unlocks all your OTPs for the attacker (who slipped some teenaged phone salesman $50 or a fake ID to swap your sims.) SMS is cancer…

curious, why SMS is insecure? It's not like a hacker can simply clone your sim.

A hacker doesn't need to clone your SIM, all they need is access to an SS7 line almost anywhere in the world and they can see your messages, regardless of carrier or phone. I suppose North Korea probably doesn't have access to SS7 servers, but that might just be the only one. Granted, SS7 isn't cheap or easy to get access to, but when it comes to banking fraud, the economics change.

The victim will be disconnected from the network, but there's no way in hell the first line of carrier support will detect any of this. You'll have to put your faith in the security monitoring of your carrier (the ones letting spoofed numbers in and out of the network, so good luck I guess). There's absolutely nothing you can do about this thread other than hope that your carrier is smart enough and that you're not important enough for a sophisticated fraudster to target.

As for cheaper threads, everyone who tweeted about owning a crypto exchange account with their phone number on display will probably lose their SIM at some point. SIM swapping is easy with a fake ID, and people within phone stores have been caught doing it from the inside.

SMS is insecure and often abused. Don't use it. Maybe also disable 2G on your phone while you're at it.

Re: Ente Auth: open-source Authy alternative for 2FA

#169

Post by [deleted] »

vishnumohandas wrote: post #66

Hello, one of the folks working on Ente Auth here. Thanks for putting us on the frontpage! To give some context, we built Auth for ourselves because we wanted a product that was cross-platform, open source[1] and offered end-to-end encrypted backups[2]. Since launch[3], the product has undergone iterations[4][5]. Auth is now available on Android, iOS, Linux, Mac and Windows[6]. We also have a read-only companion app…

[deleted]

Re: Ente Auth: open-source Authy alternative for 2FA

#170

Post by DavideNL »

evulhotdog wrote: post #12
DavideNL wrote: post #6

Earlier quoted context omitted.

Yea, i was hoping for iCloud / Apple Watch support..but unfortunately: https://github.com/ente-io/ente/issues/182

So basically there’s no reason to use this over something with a bit more trust, like Bitwarden’s 2FA app.

Well, a downside of Bitwarden (and 1Password) might be that it's hosted on their own servers. So, no separation between the App Developer/software, and the location where your data is stored.
Post reply on HN