As good a time as any to buy them a beer [0], I have been happily using it for quite some time.
Aegis Authenticator – Secure 2FA App for Android
21–30 of 143 posts
Re: Aegis Authenticator – Secure 2FA App for Android
#22I am considering switching from authy because it still doesn't have folders or collections or tags but the transition is annoying without root on android. Also wondering how people ensure they can restore if your phone dies?
I did the transition by extracting keys from the desktop app using the scripts mentioned in this gist[1] and its comments. Of course, you should not do this unless you are comfortable verifying the security of the scripts yourself.
Importing to Aegis afterwards was quite straight-forward.
[1]: https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d...
Re: Aegis Authenticator – Secure 2FA App for Android
#23I’ve been migrating away from TOTP since it’s so easily phished but my current approach is to use Yubikeys with their app: https://www.yubico.com/products/yubico-authenticator/ That avoids keeping the seeds somewhere a general attack could get (and requiring a tap complicates attacks) and works across all of my devices. The main drawback is that there isn’t an easy way to install a seed on multiple keys when first en…
I use webauthn where ever available, but considering how rare that is, I might start using this. How well does it work on mobile? Totp via app, tap the nfc key to the phone? And what does "no easy way" mean, how involved is that process? I’d prefer to have the keys on all 3 (or 4, not sure if the security key allows TOTP) sticks.
Yes, on mobile you either plug the YubiKey into your devices USB-C (or lightning) port, or tap the YubiKey to your phone. The totp secrets live on the yubikey and can't be extracted. You can only read out the current code. I believe you can also secure your YubiKey with a password so it must be entered to see the codes.
If you wish to have the same TOTPs on multiple YubiKeys, you are recommended to take a screenshot of the QR code you're given at the beginning (which contains the secret key), and manually add it to all the backup keys you prefer, and then securely erase the screenshot.
further reading: https://support.yubico.com/hc/en-us/articles/360013789259-Us...
Re: Aegis Authenticator – Secure 2FA App for Android
#24The killer feature for me is a way to quickly access tokens in my (cloud-side, encrypted) vault from a desktop (or web) app in case of emergency. It's not clear to me if Aegis allows this somehow? The other day I broke my phone. I was traveling and needed to do some 2FA level changes to a GH repo asap. I didn't even know there was an Authy desktop app until then. It saved my ass, literally.
Aegis is fully offline and doesn't have an official desktop application. You could of course create an export of your Aegis vault and import it in a third-party desktop application, like GNOME's Authenticator or OTPClient.
This is what I do. Two "live" authenticators with my phone and laptop and a secure offsite backup.
I don't add new keys particularily often, so it isn't that big of a hassle two manually sync the authenticators.
Re: Aegis Authenticator – Secure 2FA App for Android
#25I used the one by Twilio but switched my TOTP codes over to 1Password which I was already using anyway. I get that there's a security benefit of not having them in the same app but it's just not practical for me.
Re: Aegis Authenticator – Secure 2FA App for Android
#26I didn't know Aegis supported the Nextcloud backup target! I was hacking my way around on earlier versions of Android using Solid Explorer's connection to my Nextcloud, but that stopped working somewhere along the way.
Reconnected via the Storage Access Framework and backups are syncing!
Thank you, alexbakker
Re: Aegis Authenticator – Secure 2FA App for Android
#27Thanks for supporting the Nextcloud backup - win win!
App is perfect, just a single feedback: Possibly find a way to auto-populate the logo images of the apps?
Re: Aegis Authenticator – Secure 2FA App for Android
#28The killer feature for me is a way to quickly access tokens in my (cloud-side, encrypted) vault from a desktop (or web) app in case of emergency. It's not clear to me if Aegis allows this somehow? The other day I broke my phone. I was traveling and needed to do some 2FA level changes to a GH repo asap. I didn't even know there was an Authy desktop app until then. It saved my ass, literally.
Try http://totp.app
Re: Aegis Authenticator – Secure 2FA App for Android
#29Earlier quoted context omitted.
I use webauthn where ever available, but considering how rare that is, I might start using this. How well does it work on mobile? Totp via app, tap the nfc key to the phone? And what does "no easy way" mean, how involved is that process? I’d prefer to have the keys on all 3 (or 4, not sure if the security key allows TOTP) sticks.
Yes, on mobile you either plug the YubiKey into your devices USB-C (or lightning) port, or tap the YubiKey to your phone. The totp secrets live on the yubikey and can't be extracted. You can only read out the current code. I believe you can also secure your YubiKey with a password so it must be entered to see the codes. If you wish to have the same TOTPs on multiple YubiKeys, you are recommended to take a screenshot…
It's worth noting that if you install Yubico Authenticator on another device and use the same key, you do have access to the codes, because as you said, they're stored on the key.
I initially thought the codes were stored on my phone and the key was only required for access, but that's not the case.
That's either a benefit or a drawback, depending on your threat model, but it's definitely something people should understand.
Re: Aegis Authenticator – Secure 2FA App for Android
#30Earlier quoted context omitted.
I use webauthn where ever available, but considering how rare that is, I might start using this. How well does it work on mobile? Totp via app, tap the nfc key to the phone? And what does "no easy way" mean, how involved is that process? I’d prefer to have the keys on all 3 (or 4, not sure if the security key allows TOTP) sticks.
Yes, on mobile you either plug the YubiKey into your devices USB-C (or lightning) port, or tap the YubiKey to your phone. The totp secrets live on the yubikey and can't be extracted. You can only read out the current code. I believe you can also secure your YubiKey with a password so it must be entered to see the codes. If you wish to have the same TOTPs on multiple YubiKeys, you are recommended to take a screenshot…
What happens if the Yubikey gets damaged?