Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ente Auth: open-source Authy alternative for 2FA

ente.io

Post reply on HN
Print view View original

131–140 of 209 posts

Re: Ente Auth: open-source Authy alternative for 2FA

#131

Post by etskinner »

nextos wrote: post #82
xp84 wrote: post #76

Earlier quoted context omitted.

THE problem with Authy in my humble opinion isn’t just that it’s an obnoxious proprietary app I shouldn’t need — it’s that it forces you to accept SMS as a get-out-of-security-free card. Being able to get a reset text to your registered number (and you MUST register a number, of course) unlocks all your OTPs for the attacker (who slipped some teenaged phone salesman $50 or a fake ID to swap your sims.) SMS is cancer…

Regulators should mandate 2FA with an OTP standard, such as OATH TOTP. Here in EU, lots of banks use their own proprietary OTP-like standard or SMS. I never understood why SMS are preferred to OTPs generated offline using credit cards and a card reader, which were fairly popular. Actually, EU regulations state SMS should be phased out, but banks largely ignore that. SIM cloning is fairly easy...

The reason that SMS is preferred is that "everyone has it". Requiring all customers to get an app is much harder than requiring them to have a phone number than can receive SMS

Re: Ente Auth: open-source Authy alternative for 2FA

#132

Post by brewdad »

jamesralph8555 wrote: post #55

I’ve had a really poor experience with the (open source) 2FA app Raivo on ios. Developer got bought out. Ads got added, and a bug was introduced where users lost 2fa backup. Losing 2fa access was not as bad as I expected since I stored 2fa backup codes in bitwarden notes. A lot of sites also feature email recovery. I ended up migrating totp 2fa to bitwarden and its been very convenient.

I moved to 2FAS Authenticator mainly because I didn't want my 2FA tokens linked up with my Bitwarden account. I backup my tokens in an offline KeePassX vault to ensure I won't lose access to them.

Re: Ente Auth: open-source Authy alternative for 2FA

#133

Post by ecesena »

vishnumohandas wrote: post #106
ecesena wrote: post #104

Earlier quoted context omitted.

Out of curiosity, have you tested what happens if you buy a new iPhone and upgrade from old to new one? (Preferably no backup, just the new/standard upgrade procedure where you bring the new device close to the old one, and Apple does its magic.) The only reason why I use (and recommend) Authy is that when I get a new phone it just works, while other apps require to somehow open them and do some operation between old…

We have intentionally opted out of this[1][2] for now, since we did not want to create a dependency on iCloud for backups. So if you purchase a new device, you will either have to sign in to Ente Auth again (for E2EE sync), or export your codes from the older device, and import it to the newer device. [1]: https://github.com/ente-io/ente/blob/8b696b1242bce2f166ddd6a... [2]: https://github.com/mogol/flutter_secure_sto…

Thank you. FWIW, my need comes primarily from non-technical/inexperienced users. I can't tell my parents/many friends to remember to "sign into all these apps" as soon as they get a new phone, or they loose access to banks & co. Regardless I appreciate that at least you made a conscious decision.

Re: Ente Auth: open-source Authy alternative for 2FA

#134

Post by ecesena »

radicality wrote: post #105
ecesena wrote: post #104

Earlier quoted context omitted.

Out of curiosity, have you tested what happens if you buy a new iPhone and upgrade from old to new one? (Preferably no backup, just the new/standard upgrade procedure where you bring the new device close to the old one, and Apple does its magic.) The only reason why I use (and recommend) Authy is that when I get a new phone it just works, while other apps require to somehow open them and do some operation between old…

If you’re in the Apple/iOS ecosystem and want the syncing to happen via iCloud, you might as well use Apple’s built-in password manager which has support for 2FA codes.

Oh wow, I missed the release. Will def test it. I've been using authy since 2017, anything I said above might need a refresh :)

Re: Ente Auth: open-source Authy alternative for 2FA

#135

Post by UberFly »

Loranubi wrote: post #130

Because I got fed up with all the existing 2FA apps (lack of backup, export, ...) I created a simple (desktop) CLI app which works for me: https://github.com/Dobatymo/otp-tool It's just a one day project so far. But it has some nice features like taking a screenshot and reading qr codes from it and storing everything in a single enrypted file (which you can easily put on a cloud drive if you want to sync, otherwise i…

Nice role-your-own solution. Just a FYI - Aegis does have backup, export etc. I would also not use it if it couldn't export.

Re: Ente Auth: open-source Authy alternative for 2FA

#136

Post by croemer »

nextos wrote: post #114
benoliver999 wrote: post #103

Earlier quoted context omitted.

The readers cost money and people lose them. I still have one for one bank but otherwise it's SMS everywhere. They clearly just don't see it as a realistic threat, on top of all the other security measures in place (for me it's a password, and also a memorable word that isn't typed on the keyboard, then SMS OTP). It's not a great defence of SMS but perfect is the enemy of good, and SMS is just about ok. Most hacking…

At least here, SIM cloning is a very popular attack.

Where is here? We can't see your geo coordinates :p

Re: Ente Auth: open-source Authy alternative for 2FA

#137

Post by kevincox »

etskinner wrote: post #131
nextos wrote: post #82

Earlier quoted context omitted.

Regulators should mandate 2FA with an OTP standard, such as OATH TOTP. Here in EU, lots of banks use their own proprietary OTP-like standard or SMS. I never understood why SMS are preferred to OTPs generated offline using credit cards and a card reader, which were fairly popular. Actually, EU regulations state SMS should be phased out, but banks largely ignore that. SIM cloning is fairly easy...

The reason that SMS is preferred is that "everyone has it". Requiring all customers to get an app is much harder than requiring them to have a phone number than can receive SMS

"everyone has it" and it is "good enough" at preventing large scale attacks like credential stuffing from data breaches.

Most online services aren't so worried about a small number of users being SIM-swapped. They are worried about large numbers of users that reused their password across thousands of sites 5 of which had their database dumped.

SMS 2FA isn't about providing individual users a high level of security. It is about providing a baseline level of security for all users.

Re: Ente Auth: open-source Authy alternative for 2FA

#138

Post by vishnumohandas »

toomuchtodo wrote: post #124
benoliver999 wrote: post #103

Earlier quoted context omitted.

The readers cost money and people lose them. I still have one for one bank but otherwise it's SMS everywhere. They clearly just don't see it as a realistic threat, on top of all the other security measures in place (for me it's a password, and also a memorable word that isn't typed on the keyboard, then SMS OTP). It's not a great defence of SMS but perfect is the enemy of good, and SMS is just about ok. Most hacking…

Passkeys.

Not a portable format, yet.

Re: Ente Auth: open-source Authy alternative for 2FA

#139

Post by vishnumohandas »

memset wrote: post #121
vishnumohandas wrote: post #98

Earlier quoted context omitted.

Hey, would you mind sharing how you exported your codes out of Authy?

https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d...

Thanks! But this method requires Authy's Desktop client, which is unfortunately unavailable at this point.

Also, if this comment[1] is right, API access has also been broken.

[1]: https://news.ycombinator.com/item?id=40885456

Re: Ente Auth: open-source Authy alternative for 2FA

#140

Post by captn3m0 »

ecesena wrote: post #104
vishnumohandas wrote: post #66

Hello, one of the folks working on Ente Auth here. Thanks for putting us on the frontpage! To give some context, we built Auth for ourselves because we wanted a product that was cross-platform, open source[1] and offered end-to-end encrypted backups[2]. Since launch[3], the product has undergone iterations[4][5]. Auth is now available on Android, iOS, Linux, Mac and Windows[6]. We also have a read-only companion app…

Out of curiosity, have you tested what happens if you buy a new iPhone and upgrade from old to new one? (Preferably no backup, just the new/standard upgrade procedure where you bring the new device close to the old one, and Apple does its magic.) The only reason why I use (and recommend) Authy is that when I get a new phone it just works, while other apps require to somehow open them and do some operation between old…

I use Tofu on iOS and it nicely migrated my tokens from a iPhone SE to a 13 Mini. It does not do iCloud backups, so it was a straight device to device transfer.
Post reply on HN