- cross-posted to:
- privacy@lemmy.ml
- cross-posted to:
- privacy@lemmy.ml
Nevertheless I chose my Yubikey instead.
You must log in or register to comment.
that’s a refreshing change from the regular Google Authenticator and Authy mentions.
What’s wrong with Authy?
Nothing
Apparently it is hard to export out of authy
Microsoft authenticator has joined the chat
Good to know, thank you.
Since it’s nice and easy to move to any device, I hadn’t really noticed that yet. I dislike when people put sneaky walls up to keep me from my own data
Here is their justification:
In order to maintain security for our users, the Authy application does not allow importing or exporting 2FA account tokens.
Users who want to import or export their tokens can follow this process:
- Login to the desired online account with your existing 2FA token.
- Disable 2FA in the app’s site.
- Re-enable 2FA again in the app’s site.
- Scan the QR code, optionally write the Authentication Key, this time on the desired 2FA App.
https://support.authy.com/hc/en-us/articles/1260805179070-Export-or-Import-Tokens-in-the-Authy-app
EhrenBVG. Wie immer.
Incredibly based.
Come to think of it, it’s sad how we’ve got so accustomed to be suggested Google Authenticator and the other big corp data funnel 2FA apps by the services that support itIf you get Bitwarden pro (really cheap), you can save an OTP link together with the site credentials, it’s really good for keeping everything in one place
This isn’t really a good idea because then you’re putting all your eggs in one basket. The whole point of 2FA is that the second factor is in a separate location so if your first factor (password) gets compromised the second one (OTP code) still protects your account. If both factors are in one place you’re back to a single point of failure instead of 2, losing a key benefit of 2FA.
If you’re gonna do this, at the very least have 2FA with a security key on your bitwarden vault.
If you get Vaultwarden, absolutely free, you don’t have to pay and have full control over your data. It’s a win-win!
Proton pass can also do this
In India, they force us to install proprietary apps, which are probably spying on us.
They don’t, though? Who’s forcing you to install a proprietary 2FA app in India. Unless you’re saying in general.
My bank, for example, does not let us use any 2FA app we want. They have their own separate app, made for handling 2FA for that specific bank only.
And in general too, yes. Like Arogya Setu. The app we had to install to prove our vaccination status.
BVG is acronym for Berliner Verkehrsbetriebe, Berlin’s public transport agency.
I self host Bitwarden (Vaultwarden) so I just use the built-in TOTP authenticator in the Bitwarden app. It’s nice to have it all in one place + having auto copy and paste when I log in. And because I self host, it’s all backed up securely and with (as far as I know) no real backdoors.
ETA: just realized what community this is in. people that replied to me I’m sorry lmao, I’m not a nut about this kinda stuff and I’m by no means recommending this just like using it this way for convenience factor and to keep the likes of google out of my password.
No, please do not do this. Two factor authentication should be just that: two separate factors of authenticating yourself. Having them combined in one is the same as one factor.
Said in the reply to the other comment here, but I don’t really self host for security/privacy sake. And in addition to that comment I’d also like to say that I do use a YubiKey when possible for MFA. I’m not a security nut enough to care about TOTP (which kinda sucks anyway) all too much but for important things I do use physical MFA.
deleted by creator
I have a really long password on Bitwarden like 30+. I use OnlyKey to store this password on a hardware device.
You mentioned phones. My problem with using another 2FA app is that it’s still on my phone.
Yeah it compromises the idea of a second factor. Bitwarden is the worst choice. It’s only one thing: comfortable
Fair, although I’ve said in a comment on this account somewhere else, I self host more for convenience sake than anything. I just like having my own password manager, sure it’s not as secure to use it for MFA but it’s better than giving my passwords to Google, LastPass, etc. and then using eg Google Authenticator. Self hosting is more a corporate distrust thing than a privacy thing for me
I do the same thing. And Bitwarden’s 2FA is off my phone. In a complicated world, it’s reasonable to keep 1 password + 2FA as secure as possible. I simply can’t handle the hassle of pulling out my phone for every 2FA login, but still value the protection 2FA + randomly generated passwords provide.
andOTP is opensource, backs up locally, remotely, encrypted, or unencrypted. has no back doors, and will work with any DFA i can chuck at it.
its an archived project but still works fine in modern android
deleted
Here is active fork.
https://github.com/helloworld1/FreeOTPPlusSick! I didn’t think to look at the forks but that’s amazing.
Are there well known TOTP apps with backdoors?
Anything closed source could have backdoors. Trust no one.
Why does MS Authenticator need GPS permissions?
https://play.google.com/store/apps/datasafety?id=com.azure.authenticator
As per their FAQ:
Permission to access your location
Q: I got a prompt asking me to grant permission for the app to access my location. Why am I seeing this?
A: You will see a prompt from the Authenticator app asking for access to your location if your IT admin has created a policy requiring you to share your GPS location before you are allowed to access specific resources. You’ll need to share your location once every hour to ensure you are still within a country where you are allowed to access the resource.
And? I don’t give a shit what the admins of my network want. It’s DFA – they don’t deserve to know that. Ergo, I don’t use the MS app. They can kiss my ass and fire me if they don’t trust where I am.
It’s a security / compliance policy. There is a very high chance your company has not even enabled it, have not seen anyone using it.
As I see it, you would and could use it only if you force MS Authenticator notification as the only MFA method and it is important in which country MFA prompt originates. Usually it is IP based block / whitelist which checks IP from which login originates which seems like a much more useful info, then you can also allow any MFA method.
You can always deny permissions to apps.
You’re not convincing me.
It’s rather sick to an app that’s open source
Your question was why GPS permission is needed, you should now know why.
I am using MS Authenticator and Aegis. Using MS authenticator only for work accounts that have been setup for number matching feature, it is pretty nice to simply enter 2 digits in app than entering 6 digits in client itself any time you need to approve MFA.
Everything else that supports standard TOTP whether work related or personal is on Aegis - it is a much better TOTP app.
Why not Aegis?
why not 2fas
I went for another foss one a while ago, works flawlessly https://authenticatorpro.jmh.me/
That’s the one i use too, really a nice app
FreeOTP+ is the choice not Free OTP…
According to Wikipedia it’s based on google authenticator. Is it known how much google code is still in there?
deleted
only what I don’t like in FreeOTP is lack of passcode or biometrics
This is becoming a trend and I really don’t like it.
What exactly?
Setting restrictions on what 2FA/authenticators we can use. I imagine it’s only a matter of time before Google functionally makes it so you can only use theirs when using their services.
Edit: I assumed it was some of the messages I’ve seen elsewhere, my mistake. I don’t need everybody repeating the same comment. Please read the responses before telling me the exact same thing over and over again guys lol
They recommend these two. Under the recommendations it even says you can also use different apps…
At least for what I just posted this isn’t a restriction. Its a recommendation. You can still use any other app. I thought its nice that they recommend the privacy friendly ones.
It literally says “Other authenticator apps that support OTP […] can also be used”.
I’ve gone tons of places that say use Google Authenticator (only) and I just summon the QR code and scan with Aegis anyway and it always works fine. I’ve never seen a place that required a certain one.
2fas
