Hacker News Reader

Comment by AznHisoka | Hacker News Reader

One thing that makes me hesitant on changing my phone is Google Authenticator. I still have some services using that instead of Authy. I got my secret codes but it will be a hassle to use them when the time comes...

View on HN

I replaced both Authy and Google Authenticator with 1Password; it is really nice to have OTPs all in one place and sync'd across mobile devices and laptops.

I don't understand the problem. I went from 100% Google Authenticator to 100% Authy. It's a pain to turn off 2FA, then turn it back on using Authy instead of Google, but it's 100% under your control. So you can do 2 or 3 a day until you're done or one long session.

Now I have 2 devices that I can use, which makes me much less fearful about losing (or more likely misplacing) my phone.

I use KeePassXC on a Linux desktop and store the 2FA codes in it. Every site that offers 2FA will let you use a code instead of scanning the QR image. As long as I have the underlying codes I can reuse them anywhere else.

In iOS I use 'Authenticator' - https://github.com/mattrubin/Authenticator. It's open source.

I wonder if there's an equivalent on iOS for andOTP. It puts the backup responsibility on the user in which you can export all tokens to plaintext or password-secured encrypted text. You ultimately put trust in the app maintainers instead of a third party like Authy.

Checkout OTP Auth, which does all that. Very friendly, and very well written with excellent attention to usability details. No net connection unless you enable iCloud saving. No ads even in the free version. Well worth the tiny donation for premium!

I have no connection other than being a happy premium user for around 2 years. By far the best of those I found.

https://itunes.apple.com/us/app/otp-auth/id659877384

1Password is a great option for everything password related on iOS/macOS. Just watch out for the sticker shock :D

Sorry to go off on a tangent, but do you recommend Authy instead/because of this?

Jumping in to reply because I made the switch to Authy about two years ago and haven't looked back. You get the ability to sync MFA across devices and desktop without a hitch. Add in the backup (with encryption) and you can onboard a device quickly and it fits every use case I need.

Couldn't you just use Yubikeys to hold your TOTP secrets? If you want redundancy, just set up 2 or 3 and keep the extras safe.

I actually just completed a migration from Authenticator to Authy. I don’t have much to say except that it was pretty seamless. Sync between multiple devices works very well. I’m not a fan of the Authy UI but it does what I need.

If you use a password manager that supports OTP tokens (lastpass with their authenticator app, 1password, bitwarden) you could just use that and remove Authy out of the picture.

You really shouldn't be storing OTP tokens in your password manager. Yes it's better than nothing, but if your password manager vault gets compromised your 2FA does nothing to stop it.

If my password manager vault gets compromised I have bigger problems than my OTP codes.

I full throatedly recommend authy.

Reply on news.ycombinator.com