201–209 of 209 posts
Anyone else confused with this name vs Microsoft Entra, the new name for Active Directory? Is there any shared etymology between Ente and Entra? I'm curious where both come from.
If you're interested, here's more of the backstory: https://ente.io/blog/ducky/
Earlier quoted context omitted.
So basically there’s no reason to use this over something with a bit more trust, like Bitwarden’s 2FA app.
Well, a downside of Bitwarden (and 1Password) might be that it's hosted on their own servers. So, no separation between the App Developer/software, and the location where your data is stored.
Earlier quoted context omitted.
Well, a downside of Bitwarden (and 1Password) might be that it's hosted on their own servers. So, no separation between the App Developer/software, and the location where your data is stored.
Which service does have separation?
Earlier quoted context omitted.
THE problem with Authy in my humble opinion isn’t just that it’s an obnoxious proprietary app I shouldn’t need — it’s that it forces you to accept SMS as a get-out-of-security-free card. Being able to get a reset text to your registered number (and you MUST register a number, of course) unlocks all your OTPs for the attacker (who slipped some teenaged phone salesman $50 or a fake ID to swap your sims.) SMS is cancer…
Authy isn't that proprietary, and neither is Google Authenticator or Microsoft Authenticator (?). They are closed source apps but they aren't proprietary forms of TOTP. I've been able to use Yubikey Authenticator for anything that said it wanted any of the above, and the awesome thing is you can plug the Yubikey into another device, install and open up Yubikey Authenicator on that device and it works just fine and ha…
Another reason it's terrible is for business. Lots of businesses have an account that several people will need to access (yes, it's great to have multiple user support, but not all things do, or sometimes you need a 'bot user'). With something that supports real TOTP you can put that secret into 1password (or heck, scan the code into 7 different people's phone authenticator apps). With Authy you have to pick some random person's cell phone to tie that account to, and hope they don't go on vacation.
Earlier quoted context omitted.
Physical Security Key > TOTP/Authenticator Apps > SMS 2FA
Requiring a TOTP to get into the app handling your TOTP might not be the easiest for most. A strong encryption password on Authy prevents this and you can also disable multi-device / enrollment when not needed.
Earlier quoted context omitted.
Thank you! Apps like Auth are a great fit for Flutter, where desktop support is nice to have. We're also using Flutter for our Photos[1] app, and it has served us well so far. Wherever necessary (cryptography, ML, transcoding, ...), we use a bridge to communicate with the native layer, and Flutter becomes a presentation layer of sorts. Reg. Gmail marking our verification emails going to spam, we aren't sure what the…
The migration guides dont work as of the hack as they all rely on desktop tools which used the api that script kiddies used to dump that list of 33m phone numbers. Any updated guides?
1. Unlock the bootloader (if not already done) (this will wipe your device)
2. Install Authy on it and log into your Authy account
3. Root your device (I used Magisk https://github.com/topjohnwu/Magisk)
4. Once rooted, you can access the Authy app data and extract the TOTP secrets, then import them into a different app (there's a script to make this easier here https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d..., but you can also just go exploring manually in the root file system and find the Authy storage file)
It was somewhat of a pain in the ass to do this, but Authy really annoyed me with how difficult they make it to migrate off of their bullshit, so it was worth it to me to finally be able to delete their app after extracting the secrets this way.
I'm very happy with Aegis.
Earlier quoted context omitted.
Requiring a TOTP to get into the app handling your TOTP might not be the easiest for most. A strong encryption password on Authy prevents this and you can also disable multi-device / enrollment when not needed.
If Authy wants to not be a joke, then they should end their mandatory SMS authentication method, then. I certainly am not going to trust it when there's an SMS requirement to even get in. Because I (not unreasonably) assume if you contact Authy support and can pass their SMS check, they might have some way of "giving you back access to your account" and by "you" I mean criminals posing as you.
Once logged in, you need to enter that "second" password in order to get access to the TOTP codes and Authy will notify you of the new device connected.