Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ente Auth: open-source Authy alternative for 2FA

ente.io

Post reply on HN
Print view View original

151–160 of 209 posts

Re: Ente Auth: open-source Authy alternative for 2FA

#151

Post by moontear »

evolve2k wrote: post #19

My hunt for an open source Authy took me to 2FAS, which has been fine. Any opinions on this offering? 2FAS — the Internet’s favorite open-source two-factor authenticator https://2fas.com

I come from Authy and switched due to the desktop apps demise.

2FAS does not have a desktop app and and doesn’t offer self hosting. The browser extension is fine, but was clunky at times. I started disliking using a browser extension as my main thing to manage 2FA. I feel a lot better with the Ente Auth desktop app and mobile apps.

You can actually import stuff to 2FAS as well as Ente Auth, so no problem in trying out both.

Re: Ente Auth: open-source Authy alternative for 2FA

#153

Post by jerrygoyal »

vishnumohandas wrote: post #66

Hello, one of the folks working on Ente Auth here. Thanks for putting us on the frontpage! To give some context, we built Auth for ourselves because we wanted a product that was cross-platform, open source[1] and offered end-to-end encrypted backups[2]. Since launch[3], the product has undergone iterations[4][5]. Auth is now available on Android, iOS, Linux, Mac and Windows[6]. We also have a read-only companion app…

if i lose all my devices can i still recover 2fa accounts? I can do it in Authy with email and mobile verification.

Re: Ente Auth: open-source Authy alternative for 2FA

#154

Post by jerrygoyal »

xp84 wrote: post #76
secstate wrote: post #28

I feel like this misses the problem with Authy. There are hundreds, possibly thousands of 2FA alternatives for Authy. But when my 401K provider requires Authy to login in without providing a generic 2FA option, THAT is the problem.

THE problem with Authy in my humble opinion isn’t just that it’s an obnoxious proprietary app I shouldn’t need — it’s that it forces you to accept SMS as a get-out-of-security-free card. Being able to get a reset text to your registered number (and you MUST register a number, of course) unlocks all your OTPs for the attacker (who slipped some teenaged phone salesman $50 or a fake ID to swap your sims.) SMS is cancer…

curious, why SMS is insecure? It's not like a hacker can simply clone your sim.

Re: Ente Auth: open-source Authy alternative for 2FA

#155

Post by fragmede »

jerrygoyal wrote: post #154
xp84 wrote: post #76

Earlier quoted context omitted.

THE problem with Authy in my humble opinion isn’t just that it’s an obnoxious proprietary app I shouldn’t need — it’s that it forces you to accept SMS as a get-out-of-security-free card. Being able to get a reset text to your registered number (and you MUST register a number, of course) unlocks all your OTPs for the attacker (who slipped some teenaged phone salesman $50 or a fake ID to swap your sims.) SMS is cancer…

curious, why SMS is insecure? It's not like a hacker can simply clone your sim.

No, that's the problem, a hacker can clone your SIM. it's not trivial, but it's not impossibly hard, as in there are known attacks and if your fortune is protected by SMS 2fa, you'd better hope you don't draw attention from a motivated attacker. SS7 attacks and others are not theoretical.

Re: Ente Auth: open-source Authy alternative for 2FA

#156

Post by jpalomaki »

nextos wrote: post #82
xp84 wrote: post #76

Earlier quoted context omitted.

THE problem with Authy in my humble opinion isn’t just that it’s an obnoxious proprietary app I shouldn’t need — it’s that it forces you to accept SMS as a get-out-of-security-free card. Being able to get a reset text to your registered number (and you MUST register a number, of course) unlocks all your OTPs for the attacker (who slipped some teenaged phone salesman $50 or a fake ID to swap your sims.) SMS is cancer…

Regulators should mandate 2FA with an OTP standard, such as OATH TOTP. Here in EU, lots of banks use their own proprietary OTP-like standard or SMS. I never understood why SMS are preferred to OTPs generated offline using credit cards and a card reader, which were fairly popular. Actually, EU regulations state SMS should be phased out, but banks largely ignore that. SIM cloning is fairly easy...

The main problem with secure device based 2FA is how to handle the case when device gets lost and you don't have backups (many people don't really think this kind of stuff beforehand). How can a person re-establish their identity? For services like Google, Facebook etc. the answer might be "you don't", but it is more difficult for companies where the end user is also the customer.

And I think the best answer is government issued digital identity and being able to use that to recover your access to the online services (of course up to you if you wish to make this connection).

Re: Ente Auth: open-source Authy alternative for 2FA

#157

Post by vishnumohandas »

jerrygoyal wrote: post #153
vishnumohandas wrote: post #66

Hello, one of the folks working on Ente Auth here. Thanks for putting us on the frontpage! To give some context, we built Auth for ourselves because we wanted a product that was cross-platform, open source[1] and offered end-to-end encrypted backups[2]. Since launch[3], the product has undergone iterations[4][5]. Auth is now available on Android, iOS, Linux, Mac and Windows[6]. We also have a read-only companion app…

if i lose all my devices can i still recover 2fa accounts? I can do it in Authy with email and mobile verification.

Yes, you can.

Ente Auth backs up your codes, end-to-end encrypted. You can access your data on any device, at any time with your email address and password (/recovery key).

Re: Ente Auth: open-source Authy alternative for 2FA

#158

Post by princevegeta89 »

uyzstvqs wrote: post #22
csdreamer7 wrote: post #8

People complaining about an "Authy jail" and yet I have no issues with Aegis. Which is also open source, available in the f-droid store, and been around for years.

Aegis, Bitwarden Authenticator, FreeOTP, and now Ente Auth. These are the best ones.

+1 I just host my Vaultwarden server and then, I have all my 2FA secrets in my vault as well. Works very conveniently with autofill enabled by default for OTP codes.

I just have a strong vault password for my vault and that should be more than enough I guess

Re: Ente Auth: open-source Authy alternative for 2FA

#159

Post by bberenberg »

vishnumohandas wrote: post #106
ecesena wrote: post #104

Earlier quoted context omitted.

Out of curiosity, have you tested what happens if you buy a new iPhone and upgrade from old to new one? (Preferably no backup, just the new/standard upgrade procedure where you bring the new device close to the old one, and Apple does its magic.) The only reason why I use (and recommend) Authy is that when I get a new phone it just works, while other apps require to somehow open them and do some operation between old…

We have intentionally opted out of this[1][2] for now, since we did not want to create a dependency on iCloud for backups. So if you purchase a new device, you will either have to sign in to Ente Auth again (for E2EE sync), or export your codes from the older device, and import it to the newer device. [1]: https://github.com/ente-io/ente/blob/8b696b1242bce2f166ddd6a... [2]: https://github.com/mogol/flutter_secure_sto…

Agreed with others here. It’s good that this was an intentional decision but I implore you to reconsider.

Re: Ente Auth: open-source Authy alternative for 2FA

#160

Post by vishnumohandas »

bberenberg wrote: post #159
vishnumohandas wrote: post #106

Earlier quoted context omitted.

We have intentionally opted out of this[1][2] for now, since we did not want to create a dependency on iCloud for backups. So if you purchase a new device, you will either have to sign in to Ente Auth again (for E2EE sync), or export your codes from the older device, and import it to the newer device. [1]: https://github.com/ente-io/ente/blob/8b696b1242bce2f166ddd6a... [2]: https://github.com/mogol/flutter_secure_sto…

Agreed with others here. It’s good that this was an intentional decision but I implore you to reconsider.

Thanks for the feedback, will reconsider.
Post reply on HN