You can securely store and generate TOTP tokens in emacs:
https://www.masteringemacs.org/article/securely-generating-t...
Since I have emacs on everything, including my phone, it's not a bad solution for my purposes.
Aegis Authenticator – Secure 2FA App for Android
71–80 of 143 posts
Re: Aegis Authenticator – Secure 2FA App for Android
#72The authenticator you use is less important than the process you use to store the TOTP QR codes/secret keys. Never just feed it into an app, always screenshot it and store it somewhere safe THEN put it in something that can generate your TOTP codes.
Re: Aegis Authenticator – Secure 2FA App for Android
#73The killer feature for me is a way to quickly access tokens in my (cloud-side, encrypted) vault from a desktop (or web) app in case of emergency. It's not clear to me if Aegis allows this somehow? The other day I broke my phone. I was traveling and needed to do some 2FA level changes to a GH repo asap. I didn't even know there was an Authy desktop app until then. It saved my ass, literally.
The answer you're looking for is Aegis vault backup + Syncthing or Nextcloud. Seriously.
I once lost my Authy app data and didn't have it installed on any other of my devices (silly requirement tbh). I don't know whether cloud or 2FA is the joke here but Authy slapped me with a 24hr wait time for a "device reset".
Re: Aegis Authenticator – Secure 2FA App for Android
#74Earlier quoted context omitted.
I'm wondering the same thing. It also looks like while Aegis is actively developed on GitHub, that hasn't materialized into a new release on the Play Store or F-Droid in 7 months.
You're right, it's been a while, but we actually issued a beta release for 2.1 today!
Nice. Will that hit F-Droid at some point? Or do we gotta wait for the non-beta release?
Re: Aegis Authenticator – Secure 2FA App for Android
#75Aegis is an excellent FOSS Authenticator that is available in FDroid. However, offline first apps are challenging to use TOTP across multiple devices. These days I just use TOTP provided by my password manager (Bitwarden) that is seamless across devices.
Re: Aegis Authenticator – Secure 2FA App for Android
#76You can securely store and generate TOTP tokens in emacs: https://www.masteringemacs.org/article/securely-generating-t... Since I have emacs on everything, including my phone, it's not a bad solution for my purposes.
Of course you can.
Re: Aegis Authenticator – Secure 2FA App for Android
#77Earlier quoted context omitted.
Yubikeys store everything on the key. I can lose my phone and use your phone to see my 2FA codes. It's honestly one of the only way MFA make sense - otherwise you lock yourself out of your entire digital life when you lose your phone and need to rely on storing your backup codes (which opens up a storage security wormhole). It's also a lot easier to wear around your neck.
The only downside is limited space on Yubikey. I am currently carrying 2 tokens :(
Up to 32, for those reading who (like me) didn’t know about this limitation.
https://support.yubico.com/hc/en-us/articles/4404456942738-F...
Re: Aegis Authenticator – Secure 2FA App for Android
#78I was happily using andOTP but seems like it has been unmaintained since June - https://github.com/andOTP/andOTP . I wish F-Droid or Play Store had a feature like GitHub's 'Archived' to inform users.
Also a happy andOTP user. Initially I thought you were being impatient because no updates for a few months isn't necessarily bad, but I see that the project itself has been updated to reflect that it is not being maintained by its creator. Thanks for the heads up.
Looking at Aegis, it appears to support importing from andOTP
Re: Aegis Authenticator – Secure 2FA App for Android
#79Just keep TOTP in your password manager at this point. Whatever security is lost by it not being a "true second factor" is made up for by not having to recover or restore backups due to a lost or stolen phone.
I use Bitwarden for TOTP, because I have become convinced that it still provides a true second factor even if both the password and the TOTP seed are in the same entry in my password manager.
This is because every access to Bitwarden requires two factors: a device I've already logged in with, and either the passphrase or a biometric unlock. Bootstrapping a new device requires the passphrase and a token.
Re: Aegis Authenticator – Secure 2FA App for Android
#80“Secure 2FA” app is an odd title. A 2FA app is nothing if it’s not secure. The “secure” bit here is redundant. The fact that it has to be said is actually a red flag. Are you saying it’s secure because in reality it really isn’t?