Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ente Auth: open-source Authy alternative for 2FA

ente.io

Post reply on HN
Print view View original

181–190 of 209 posts

Re: Ente Auth: open-source Authy alternative for 2FA

#181

Post by ensignavenger »

etskinner wrote: post #131
nextos wrote: post #82

Earlier quoted context omitted.

Regulators should mandate 2FA with an OTP standard, such as OATH TOTP. Here in EU, lots of banks use their own proprietary OTP-like standard or SMS. I never understood why SMS are preferred to OTPs generated offline using credit cards and a card reader, which were fairly popular. Actually, EU regulations state SMS should be phased out, but banks largely ignore that. SIM cloning is fairly easy...

The reason that SMS is preferred is that "everyone has it". Requiring all customers to get an app is much harder than requiring them to have a phone number than can receive SMS

Many sites are blocking my Google Voice number from being used for 2FA, so apparently not "everyone" has a number that "everyone" finds acceptable.

Re: Ente Auth: open-source Authy alternative for 2FA

#182

Post by ksec »

ecesena wrote: post #133
vishnumohandas wrote: post #106

Earlier quoted context omitted.

We have intentionally opted out of this[1][2] for now, since we did not want to create a dependency on iCloud for backups. So if you purchase a new device, you will either have to sign in to Ente Auth again (for E2EE sync), or export your codes from the older device, and import it to the newer device. [1]: https://github.com/ente-io/ente/blob/8b696b1242bce2f166ddd6a... [2]: https://github.com/mogol/flutter_secure_sto…

Thank you. FWIW, my need comes primarily from non-technical/inexperienced users. I can't tell my parents/many friends to remember to "sign into all these apps" as soon as they get a new phone, or they loose access to banks & co. Regardless I appreciate that at least you made a conscious decision.

> FWIW, my need comes primarily from non-technical/inexperienced users. I

Number one reason why most of my friends and family dont want to buy a new iPhone. They hate the pain and the anxiety of upgrading. And Apple hasn't done anything to make it easier.

Re: Ente Auth: open-source Authy alternative for 2FA

#183

Post by INTPenis »

csdreamer7 wrote: post #8

People complaining about an "Authy jail" and yet I have no issues with Aegis. Which is also open source, available in the f-droid store, and been around for years.

I never even heard of this Authy issue but people seem up in arms over it.

What I have seen though are Microsoft and Google trying to maneuver their own auth app and hiding the generic OTP option to lock people in.

As long as I can use any generic OTP app I'm happy, and Aegis is definitely my current favorite. I mean I'm a person with close to 50 OTP codes at this time, this is a serious tool in my life.

Re: Ente Auth: open-source Authy alternative for 2FA

#184

Post by codegeek »

jerrygoyal wrote: post #165
Kwpolska wrote: post #163

Earlier quoted context omitted.

A hacker can perform a SIM swap attack, where they convince the operator using bribes and/or fake IDs to provide a replacement SIM card for your number.

what's the better alternative?

Physical Security Key > TOTP/Authenticator Apps > SMS 2FA

Re: Ente Auth: open-source Authy alternative for 2FA

#185

Post by 1oooqooq »

secstate wrote: post #28

I feel like this misses the problem with Authy. There are hundreds, possibly thousands of 2FA alternatives for Authy. But when my 401K provider requires Authy to login in without providing a generic 2FA option, THAT is the problem.

oh boy, wait until you have to use anything under id.me, which is in bed with the federal govt.

you will be crying for them to let you go back to authy and sms.

Re: Ente Auth: open-source Authy alternative for 2FA

#186

Post by lelandbatey »

vishnumohandas wrote: post #66

Hello, one of the folks working on Ente Auth here. Thanks for putting us on the frontpage! To give some context, we built Auth for ourselves because we wanted a product that was cross-platform, open source[1] and offered end-to-end encrypted backups[2]. Since launch[3], the product has undergone iterations[4][5]. Auth is now available on Android, iOS, Linux, Mac and Windows[6]. We also have a read-only companion app…

Is it possible to have ente on your phone (Android) synch using e.g. Dropbox, same as KeepassXC with it's password database?

Re: Ente Auth: open-source Authy alternative for 2FA

#187

Post by dheera »

xp84 wrote: post #76
secstate wrote: post #28

I feel like this misses the problem with Authy. There are hundreds, possibly thousands of 2FA alternatives for Authy. But when my 401K provider requires Authy to login in without providing a generic 2FA option, THAT is the problem.

THE problem with Authy in my humble opinion isn’t just that it’s an obnoxious proprietary app I shouldn’t need — it’s that it forces you to accept SMS as a get-out-of-security-free card. Being able to get a reset text to your registered number (and you MUST register a number, of course) unlocks all your OTPs for the attacker (who slipped some teenaged phone salesman $50 or a fake ID to swap your sims.) SMS is cancer…

Authy isn't that proprietary, and neither is Google Authenticator or Microsoft Authenticator (?). They are closed source apps but they aren't proprietary forms of TOTP.

I've been able to use Yubikey Authenticator for anything that said it wanted any of the above, and the awesome thing is you can plug the Yubikey into another device, install and open up Yubikey Authenicator on that device and it works just fine and has all of your services stored on the hardware key, making it easy to upgrade phones or plug they key into a desktop and not depend on a phone.

Re: Ente Auth: open-source Authy alternative for 2FA

#188

Post by dheera »

fragmede wrote: post #155
jerrygoyal wrote: post #154

Earlier quoted context omitted.

curious, why SMS is insecure? It's not like a hacker can simply clone your sim.

No, that's the problem, a hacker can clone your SIM. it's not trivial , but it's not impossibly hard, as in there are known attacks and if your fortune is protected by SMS 2fa, you'd better hope you don't draw attention from a motivated attacker. SS7 attacks and others are not theoretical.

Actually all it needs is walking into the AT&T/Verizon store with a convincing fake ID + "I lost my phone"

Or a rotten apple working at the store who is working together with the perpetrator

Re: Ente Auth: open-source Authy alternative for 2FA

#189

Post by Sayrus »

codegeek wrote: post #184
jerrygoyal wrote: post #165

Earlier quoted context omitted.

what's the better alternative?

Physical Security Key > TOTP/Authenticator Apps > SMS 2FA

Requiring a TOTP to get into the app handling your TOTP might not be the easiest for most. A strong encryption password on Authy prevents this and you can also disable multi-device / enrollment when not needed.

Re: Ente Auth: open-source Authy alternative for 2FA

#190

Post by nextos »

t0bia_s wrote: post #150
nextos wrote: post #143

Earlier quoted context omitted.

I disagree. A bank reported ~1,000 SIM swap attacks happened to their clients during 2021 alone in a single EU country. That's a lot. Furthermore, these attacks target high value individuals which I imagine is a particular cause of concern for banks. For this reason, the EU has phased out SMS as a valid 2FA, although not many banks have complied yet. Some banks, like ING, already refuse to send OTPs by SMS and effect…

App, that steals my data is no go for me.

I don't like apps either, that's why I'd like standardized 2FA.
Post reply on HN