Hacker News Reader

Comment by codegeek | Hacker News Reader

One really good TOTP app for desktops is Authy [0] from Twilio. Some people are not aware that it exists and you don't need an app on your phone for TOTP. Authy works from your desktop as well.

[0] https://authy.com/download/ (scroll down to see Desktop version for download)

View on HN

Hard no from me.

I remember when Authy refused to delete my account, prior to their acquisition, despite promising to do so upon request in their terms of service. I wasn't the only one: https://news.ycombinator.com/item?id=9100525

There are plenty of free and open source TOTP authenticators (that don't require you to provide your phone number), and I don't see a good reason to use Authy over them.

What about this link? Seems pretty straightforward to delete an account for me:

https://authy.com/account/delete/

Good to see that they added an account deletion page some time between their acquisition and now. However, that bridge has already been burned for me and I'll be sticking with Bitwarden (self-hosted using Vaultwarden) for TOTP. Bitwarden doesn't require my phone number.

What's the concept behind having an Authy account? It converts a TOTP seed into a time-based TOTP code. No part of that suggests that you'd need an account.

It means getting access to your 2FA codes on a new device is as straightforward as installing the app and signing in. Other commenters have mentioned authenticator apps that let you transfer the codes by initiating a backup or generating a QR code, but that won't work if the previous device is at the bottom of a lake.

> authenticator apps that let you transfer the codes by initiating a backup or generating a QR code, but that won't work if the previous device is at the bottom of a lake.

You've got a strange definition of "backup" if you think it won't work after the subject of the backup has been destroyed. What would be the point of a backup that stopped working whenever you needed it?

That depends on whether the backups are automatic and ongoing, or if they're the "scan this QR code to transfer to a new device" type. The former will be fine if the original device is lost, the latter will not be.

There is also Aegis[1]. It's FOSS and available in F Droid and Play Store. Authy is pretty good, but doesn't support export of the secrets used for TOTP, whereas Aegis supports export to json and GPG encrypted json.

I've been using Authy for a few years, but switched to Aegis about three years ago and couldn't be happier. Since Authy doesn't support direct export of the secrets, I've had to use a workaround [2].

[1] https://getaegis.app/ [2] https://gist.github.com/JacobJohansen/5f688d45049be440b8ee87...

I was interested in using Aegis, but unfortunately I can't import my current keys from Google Authenticator.

It's "supported" but only via accesing the Authenticator's files (or by havitng root access) which in my celphone is not possible (OnePlus Nord).

Weirdly enough, Aegis does not support bulk importing keys from a QR code, which is how you can migrate from one Authenticator instance to another (e.g. to a new phone).

And I am too lazy to go over each key, reset it and load it up again in Aegis.

Hooefully they'll add this feature at some point in the future.

interesting, i migrated from authenticator, but did it 1 at a time. Check out andOTP, another great open source alternative, maybe it has these features.

https://github.com/beemdevelopment/Aegis/issues/701

Aegis does support importing from Google authenticator, it just doesn't make that very clear. You do it the same way you add any other code. The hard part for me was getting the QR code into scannable form. This issue explains one way, but you can also just take a picture of the phone with another device.

I can recommend oathtool (in combination with GPG) on the CLI: https://www.nongnu.org/oath-toolkit/oathtool.1.html

Also, KeePassXC[0] (a password manager) has integrated TOTP, which is very handy.

[0] https://keepassxc.org/

Wow really? I never knew that, I've been using andOTP.

Note that authy’s login (twilio login) uses sms-based 2fa itself, which is very vulnerable to sim-swap attacks. There is no way to disable sms 2fa on it.

To counter this I recommend disabling device sync in Authy, and only enabling it temporarily when you add a new device.

For those with a Yubikey, those people can use Yubikey Authenticator on both mobile and desktop.

+1 to this. Yes, it's a bit of a pain to setup with multiple keys, but your secret is stored within the Yubikey itself which is far more secure.

On the topic of TOTP apps, I like "OTP Auth" for iOS devices. It's fairly simple, and offers an Apple Watch client that works well.

Seconded, OTP Auth is really nice. It also syncs via iCloud and you can export your info easily.

Yep, the Apple Watch app is a killer app!

Interesting! I didn't know that. Pretty handy for corporate stuff - keep the 2FA on the work computer.

Authy once deleted local credentials during an app update. I had to restore with my backup keys.. only I lost my backup keys so I had to go the long way to circumvent my 2fa. They didn’t seem very sorry about it either.

You can also roll your own with https://github.com/pyauth/pyotp

> roll your own

Libraries for a couple of other languages:

https://crates.io/search?q=4226

https://pkg.go.dev/search?q=4226

It's almost overkill to bother with a library.

  #!/usr/bin/env python3
  import time, hmac, base64, struct
  def totp(seed,curtime,period,len):
      k = base64.b32decode(seed)
      mac = hmac.new(k, struct.pack('>Q', int(curtime/period)), 'sha1').digest()
      offset=mac[-1] & 0x0f
      otp=struct.unpack('>L', mac[offset:offset+4])[0] & 0x7fffffff
      return str(otp)[-len:].zfill(len)

  myseed='KRUGS4ZANFZSAYJAOJQW4ZDPNUQHG5DS' # use gpg or similar to store
  print(totp(myseed,time.time(),60,6))

True, I also type this in from memory whenever I need a quick TOTP calculation.

Meaning the core TOTP piece isn't much code, and a library might not store/encrypt the seed, display the data, etc, in a way that you want. The bulk of the code for an authenticator app isn't typically the TOTP bit.

You forgot to add the test cases :)

There's also an TOTP pass extension.

https://github.com/tadfisher/pass-otp

Like others have mentioned, it unlike Authy this doesn't use your phone number as identity

Authy also works on Apple Watch. I've found it very difficult to get Siri to understand "open Authy". It usually ends up saying there is no app name "oathy".

Spelling it out usually works: "open A U T H Y".

Do you pronounce "authy" and "oathy" the same way? I'd expect "authy" to use whatever vowel you use for "caught", not the vowel of "au revoir".

I've tried a variety of pronunciations. Trying for "au" as in "caught" got me "healthy" and once it opened PCalc(?!).

Pronouncing "au" like the "ou" in "ouch" seems to be about the best, but then it tends to mess up the other end, thinking I want "authi". Sometimes it even think "alfie". Somehow it even occasionally hears "elsewise" or "offline". I have no idea how it gets those.

I deleted my Authy account after the acquisition. The deletion process was a bit of a struggle for reasons I don't recall clearly.

I now use Aegis on phone and the otp plugin of pass on my Linux desktops (+ a ulauncher plugin).

The mandatory requirement of a phone number to even set this up (with SMS as the verification method) doesn’t suit me. I use other TOTP apps that don’t ask for a phone number or email address or anything else.

For iOS users, I can really recommend Raivo OTP[0] a FOSS app that offers everything Authy does (backups included) with easy ways to migrate in- and out- of the app through an encrypted ZIP export of all your TOTP keys.

[0] https://github.com/raivo-otp/ios-application

Reply on news.ycombinator.com