Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ente Auth: open-source Authy alternative for 2FA

ente.io

Post reply on HN
Print view View original

171–180 of 209 posts

Re: Ente Auth: open-source Authy alternative for 2FA

#171

Post by nerdponx »

ecesena wrote: post #133
vishnumohandas wrote: post #106

Earlier quoted context omitted.

We have intentionally opted out of this[1][2] for now, since we did not want to create a dependency on iCloud for backups. So if you purchase a new device, you will either have to sign in to Ente Auth again (for E2EE sync), or export your codes from the older device, and import it to the newer device. [1]: https://github.com/ente-io/ente/blob/8b696b1242bce2f166ddd6a... [2]: https://github.com/mogol/flutter_secure_sto…

Thank you. FWIW, my need comes primarily from non-technical/inexperienced users. I can't tell my parents/many friends to remember to "sign into all these apps" as soon as they get a new phone, or they loose access to banks & co. Regardless I appreciate that at least you made a conscious decision.

OTP Auth supports iCloud sync in the paid version.

Re: Ente Auth: open-source Authy alternative for 2FA

#172

Post by bonjurkes »

vishnumohandas wrote: post #66

Hello, one of the folks working on Ente Auth here. Thanks for putting us on the frontpage! To give some context, we built Auth for ourselves because we wanted a product that was cross-platform, open source[1] and offered end-to-end encrypted backups[2]. Since launch[3], the product has undergone iterations[4][5]. Auth is now available on Android, iOS, Linux, Mac and Windows[6]. We also have a read-only companion app…

First of all thanks for providing an alternative 2FA app on iOS platform that is open source.

I wanted to be one of the users but when I tried to import my backup from Raivo your app just gives null point exception error. I sent an email to your support team and they said they will get back to me once they hear back more from devs, which was 2 weeks ago.

For now I am using 2FAs but it would be great if I can get to try your app once importing works fine.

Good luck!

Re: Ente Auth: open-source Authy alternative for 2FA

#173

Post by OptionOfT »

nextos wrote: post #82
xp84 wrote: post #76

Earlier quoted context omitted.

THE problem with Authy in my humble opinion isn’t just that it’s an obnoxious proprietary app I shouldn’t need — it’s that it forces you to accept SMS as a get-out-of-security-free card. Being able to get a reset text to your registered number (and you MUST register a number, of course) unlocks all your OTPs for the attacker (who slipped some teenaged phone salesman $50 or a fake ID to swap your sims.) SMS is cancer…

Regulators should mandate 2FA with an OTP standard, such as OATH TOTP. Here in EU, lots of banks use their own proprietary OTP-like standard or SMS. I never understood why SMS are preferred to OTPs generated offline using credit cards and a card reader, which were fairly popular. Actually, EU regulations state SMS should be phased out, but banks largely ignore that. SIM cloning is fairly easy...

The card reader with scanning a barcode is incredibly obtrusive. It requires you to carry the card/bank specific reader with you. So when you're on the go you and want to pay something online with a debit/credit card, you need to whip out the card and the specific reader.

And it included that annoying scanning a barcode on screen AND confirming € amount.

And the readers had 2 options. Sign and confirm (?). Why they couldn't incorporate this into the barcode?

It was all done because it definitely lowered mistakes and was more secure than card number and CVV to pay online.

Re: Ente Auth: open-source Authy alternative for 2FA

#174

Post by saurik »

vishnumohandas wrote: post #106
ecesena wrote: post #104

Earlier quoted context omitted.

Out of curiosity, have you tested what happens if you buy a new iPhone and upgrade from old to new one? (Preferably no backup, just the new/standard upgrade procedure where you bring the new device close to the old one, and Apple does its magic.) The only reason why I use (and recommend) Authy is that when I get a new phone it just works, while other apps require to somehow open them and do some operation between old…

We have intentionally opted out of this[1][2] for now, since we did not want to create a dependency on iCloud for backups. So if you purchase a new device, you will either have to sign in to Ente Auth again (for E2EE sync), or export your codes from the older device, and import it to the newer device. [1]: https://github.com/ente-io/ente/blob/8b696b1242bce2f166ddd6a... [2]: https://github.com/mogol/flutter_secure_sto…

From the documentation I found for kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly, it sounds like what you are doing here is explicitly opting out of support for the usual secure mechanisms Apple users have to back up their device--such as an encrypted iTunes backup--which, to me, seems pretty egregiously wrong.

Re: Ente Auth: open-source Authy alternative for 2FA

#175

Post by cqqxo4zV46cp »

nextos wrote: post #82
xp84 wrote: post #76

Earlier quoted context omitted.

THE problem with Authy in my humble opinion isn’t just that it’s an obnoxious proprietary app I shouldn’t need — it’s that it forces you to accept SMS as a get-out-of-security-free card. Being able to get a reset text to your registered number (and you MUST register a number, of course) unlocks all your OTPs for the attacker (who slipped some teenaged phone salesman $50 or a fake ID to swap your sims.) SMS is cancer…

Regulators should mandate 2FA with an OTP standard, such as OATH TOTP. Here in EU, lots of banks use their own proprietary OTP-like standard or SMS. I never understood why SMS are preferred to OTPs generated offline using credit cards and a card reader, which were fairly popular. Actually, EU regulations state SMS should be phased out, but banks largely ignore that. SIM cloning is fairly easy...

This is a terrible, terrible idea. TOTP is secure for nerds but presents very very real security downsides for literally everyone else. Increased popularity of TOTP invites increased frequency of malicious TOTP apps exfiltrating user OTPs. This is pretty much THE reason why it’s quite common to see companies provide TOTP as a hidden, nerdy alternative. Again, if HN got what it wanted as far as tech regulation, the world would be a terrible place, but HN consistently puts nerdy desires ahead of what would actually help wider society.

Re: Ente Auth: open-source Authy alternative for 2FA

#176

Post by eviks »

bonjurkes wrote: post #172
vishnumohandas wrote: post #66

Hello, one of the folks working on Ente Auth here. Thanks for putting us on the frontpage! To give some context, we built Auth for ourselves because we wanted a product that was cross-platform, open source[1] and offered end-to-end encrypted backups[2]. Since launch[3], the product has undergone iterations[4][5]. Auth is now available on Android, iOS, Linux, Mac and Windows[6]. We also have a read-only companion app…

First of all thanks for providing an alternative 2FA app on iOS platform that is open source. I wanted to be one of the users but when I tried to import my backup from Raivo your app just gives null point exception error. I sent an email to your support team and they said they will get back to me once they hear back more from devs, which was 2 weeks ago. For now I am using 2FAs but it would be great if I can get to t…

You could try to import in pieces and try different export formats, unfortunately Ente doesn't have a great parser, so some otp codes could break the import process

Re: Ente Auth: open-source Authy alternative for 2FA

#177

Post by LorenzoGood »

vishnumohandas wrote: post #144
LorenzoGood wrote: post #142

Earlier quoted context omitted.

Does the plain text format easily translate to other apps, or are you still stuck manually copying codes over one by one?

There is no universally agreed upon format for bulk imports. We've adopted one that we found to be used by a few other apps - a plain text file with otpauth:// URIs separated by a newline.

Thanks

Re: Ente Auth: open-source Authy alternative for 2FA

#178

Post by omneity »

nickburns wrote: post #167
omneity wrote: post #122

Earlier quoted context omitted.

This is simply not true. Just today an app asked me to use Microsoft Authenticator, and scanning the QR code with Google Auth and Authy didn’t work, earning me an “Invalid QR code” error and forcing me to install the app from MS.

You assume that because you were not able to overcome whatever error/s you encountered with Google Auth and Authy, that you were being forced to use MS Authenticator.

Pretty uncharitable interpretation on your end. I am a developer and went to the extent of verifying the content of the QR code and the optional URL for manually adding it. No OTP code in there.

Try to be nicer next time.

Re: Ente Auth: open-source Authy alternative for 2FA

#180

Post by lysp »

moontear wrote: post #148
aryonoco wrote: post #126

Earlier quoted context omitted.

Why shouldn't you? I use a Yubikey as the 2FA for my bitwatden, then store all the TOTP codes with the passwords in the same vault. Quite convenient, and also adheres to the principles of MFA

If your one Bitwarden store were compromised in any way, it is game over since it also contains the 2FA codes. If you were to use two apps / two stores, there is another hurdle.

That is exactly why I do it.
Post reply on HN