Authy, Aegis, Google/MS Authenticator, AndOTP, Bitwarden - What do you use for 2FA OTP?

ElonBezos · October 10

Authy, 2PAS and Google Authenticator.

lately add microsoft's just because some clients prefer to send files using onedrive

david · October 11

@david said:

@tenebriouslypuissant said:
https://github.com/TheMaxMur/RS-Key

Great for everything that isn’t a financial institution or trading platform

Looks interesting. Have you tried it?

This looks like a fork from PicoKeys, which used to be open source but recently switched to partially closed source and began charging for license keys.

Looking at the RS-Key github, it appears to be heavily dependent on AI. Just what you probably don't want in a security key. Which is too bad, because its a good idea.

Hotmarer · October 11

Cisco Duo

itzgeo · October 11

Aegis

Dupondt · October 11

Memorize the TOTP secret.
Look at watch.
Calculate TOTP.
I'm in.

Aside from that, different 2FAs for different situations. Some website require 2FA and I could not care less if I get hacked (relative to the headache of storing properly), so there I might use a password manager to store the 2FA.

For other things, there are convenient apps like Ente, Aegis, Proton 2FA, et cetera. Cloud sync is risky but if it's truly E2EE, it shouldn't matter. Google Authenticator isn't and Google will hand over data if compelled, so consider those 2FAs as probably private from public threats but known/knowable to state-level adversaries.

I'm glad to see Authy getting recommended less and less. Had to MITM myself to migrate some TOTPs out of there.

stable_genius · October 11

2FAS

woinokiz · October 11

Authy + GA

tenebriouslypuissant · October 13

Totp.app

tenebriouslypuissant · October 13

@david said:

[@david said]keys.

Looking at the RS-Key github, it appears to be heavily dependent on AI. Just what you probably don't want in a security key. Which is too bad, because its a good idea.

Is the libreKeys project also ai?

https://github.com/librekeys/picoforge

From here three fido2 projects linked.

tenebriouslypuissant · October 13

@david said:

@tenebriouslypuissant said:
https://github.com/TheMaxMur/RS-Key

Great for everything that isn’t a financial institution or trading platform

Looks interesting. Have you tried it?

Yes and no

I bought a bunch of rp2040zero for a related project: librekeys and picoforge. It isn’t as polished as yubico. It is functional.

david · October 13

@tenebriouslypuissant said:

@david said:

[@david said]keys.

Looking at the RS-Key github, it appears to be heavily dependent on AI. Just what you probably don't want in a security key. Which is too bad, because its a good idea.

Is the libreKeys project also ai?

https://github.com/librekeys/picoforge

From here three fido2 projects linked.

Librekeys looks real, which is promising, but it doesn't look like there's much development right now. Reading the issues, there's one developer working on it and they're recommending RS-key instead.

COLBYLICIOUS · October 14

I am using Proton Pass.

OhJohn · October 14

ok, so please teach me, I'm ignorant: what is wrong with Authy? @Dupondt maybe you can elaborate on that?

Dupondt · October 14

@OhJohn said:
ok, so please teach me, I'm ignorant: what is wrong with Authy? @Dupondt maybe you can elaborate on that?

My main concerns are it's not E2EE, has past breaches, and you can't move away from it. That trifecta makes it a no-go for me.

If Authy ever decides to charge a subscription fee, you'd have no (normal/sane) way of moving away. They don't let you access the underlying secret, so you can't switch. The only way to get it out is to MITM yourself.

Every sane 2FA apps let you export. Authy does not.

jackal123 · 11:51AM

New here — currently deciding between Aegis and Bitwarden's built-in TOTP. For Aegis users: how do you handle the encrypted backups, on-device only or synced somewhere?