Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Aegis Authenticator – Secure 2FA App for Android

getaegis.app

Post reply on HN
Print view View original

31–40 of 143 posts

Re: Aegis Authenticator – Secure 2FA App for Android

#31

Post by Semaphor »

croes wrote: post #30
RockRobotRock wrote: post #23

Earlier quoted context omitted.

Yes, on mobile you either plug the YubiKey into your devices USB-C (or lightning) port, or tap the YubiKey to your phone. The totp secrets live on the yubikey and can't be extracted. You can only read out the current code. I believe you can also secure your YubiKey with a password so it must be entered to see the codes. If you wish to have the same TOTPs on multiple YubiKeys, you are recommended to take a screenshot…

What happens if the Yubikey gets damaged?

That’s why (as with essentially all YubiKey use-cases), you have backup(s).

Re: Aegis Authenticator – Secure 2FA App for Android

#32

Post by stoplying1 »

acdha wrote: post #11

I’ve been migrating away from TOTP since it’s so easily phished but my current approach is to use Yubikeys with their app: https://www.yubico.com/products/yubico-authenticator/ That avoids keeping the seeds somewhere a general attack could get (and requiring a tap complicates attacks) and works across all of my devices. The main drawback is that there isn’t an easy way to install a seed on multiple keys when first en…

"Password Store" ('pass' compatible) for Android also supports TOTP to tokens and Gpg encryption.

With Syncthing, 'gopass' and 'Android Password Store', I have a fully open source, very easy to reason about fully in my control, password and totp storage, accessible on all my devices. All of which can only be accessed with my Yubikey that I keep in my pocket and my GPG PIN.

Re: Aegis Authenticator – Secure 2FA App for Android

#33

Post by robertlagrant »

gchamonlive wrote: post #4
thr0wnawaytod4y wrote: post #2

I just put a 2FA implant in my arm

Update your threat scenario to encompass dismemberment and create a recovery protocol accordingly. Not sure you would be able to do drills, at least not a second time.

A drill would be a valid vector.

Re: Aegis Authenticator – Secure 2FA App for Android

#34

Post by GordonS »

I switched to Aegis recently, and I did it for only 2 reasons:

1) I prefer to use OSS when possible

2) Aegis supports import/export/backup - so if I get a new phone, I don't have to spend days setting up my dozens of accounts again! This also means I can setup the same OTPs in both Keepass and my phone, so I can always get into my accounts

I'm really liking it, it does the same job as the Google and Microsoft Authenticator apps, but import/export/backup means it's more usable

Re: Aegis Authenticator – Secure 2FA App for Android

#35

Post by psanford »

acdha wrote: post #11

I’ve been migrating away from TOTP since it’s so easily phished but my current approach is to use Yubikeys with their app: https://www.yubico.com/products/yubico-authenticator/ That avoids keeping the seeds somewhere a general attack could get (and requiring a tap complicates attacks) and works across all of my devices. The main drawback is that there isn’t an easy way to install a seed on multiple keys when first en…

If you are using the yubico-authenticator app then you are using TOTP, just with the seeds stored on your yubikey. This is still vulnerable to phishing.

I hope what you meant to say is that you are switching to using WebAuthn with your yubikey on all sites that support it, and then using your yubikey for TOTP on sites that don't support WebAuthn yet. WebAuthn is the thing that gives you actual protection against phishing.

Re: Aegis Authenticator – Secure 2FA App for Android

#36

Post by Rygian »

GordonS wrote: post #34

I switched to Aegis recently, and I did it for only 2 reasons: 1) I prefer to use OSS when possible 2) Aegis supports import/export/backup - so if I get a new phone, I don't have to spend days setting up my dozens of accounts again! This also means I can setup the same OTPs in both Keepass and my phone, so I can always get into my accounts I'm really liking it, it does the same job as the Google and Microsoft Authent…

I can import/export with Google authenticator (via QR codes).

Re: Aegis Authenticator – Secure 2FA App for Android

#37

Post by [deleted] »

psanford wrote: post #35
acdha wrote: post #11

I’ve been migrating away from TOTP since it’s so easily phished but my current approach is to use Yubikeys with their app: https://www.yubico.com/products/yubico-authenticator/ That avoids keeping the seeds somewhere a general attack could get (and requiring a tap complicates attacks) and works across all of my devices. The main drawback is that there isn’t an easy way to install a seed on multiple keys when first en…

If you are using the yubico-authenticator app then you are using TOTP, just with the seeds stored on your yubikey. This is still vulnerable to phishing. I hope what you meant to say is that you are switching to using WebAuthn with your yubikey on all sites that support it, and then using your yubikey for TOTP on sites that don't support WebAuthn yet. WebAuthn is the thing that gives you actual protection against phis…

[deleted]

Re: Aegis Authenticator – Secure 2FA App for Android

#38

Post by GordonS »

Rygian wrote: post #36
GordonS wrote: post #34

I switched to Aegis recently, and I did it for only 2 reasons: 1) I prefer to use OSS when possible 2) Aegis supports import/export/backup - so if I get a new phone, I don't have to spend days setting up my dozens of accounts again! This also means I can setup the same OTPs in both Keepass and my phone, so I can always get into my accounts I'm really liking it, it does the same job as the Google and Microsoft Authent…

I can import/export with Google authenticator (via QR codes).

IIRC, it didn't used to give you any control over import/export, and only supported using an opaque Google storage option. Has that changed?

Aegis gives me the actual seed, full control of the data so I can do with it as I please.

Re: Aegis Authenticator – Secure 2FA App for Android

#39

Post by branon »

Recently had a hard time exporting 20+ OTP secrets from Google Authenticator.

I believe I discovered a bug in the app: if you long press a secret > edit > leave an empty string as the comment, and then export a QR code containing this secret, your other device will fail to import ("QR code cannot be interpreted.").

I've only seen this happen with secrets where the comment is put in parentheses and appended to the regular, immutable name of the secret. There's another type of secret where the entire name can be edited, this I did not test. But if you try the import/export flow on a secret whose name contains `()` I bet you'll hit the bug.

I briefly tried Aegis but you must have Aegis+Authenticatior installed, and be root, or you can exfiltrate Authenticator's database file from private storage, which best as I can tell, also requires root. Shouldn't have gone with Authenticator at all, I've learned.

It seems optimal to simply retain the original secret (QR code or whichever medium) you are given when 2FA is initially enabled.

Later found this equivalent: https://mattscodecave.com/posts/how-to-move-from-google-auth...

Post reply on HN