Hacker News Reader

Comment by kaladin-jasnah | Hacker News Reader

Have to chime in but my favourite authenticator is andOTP. Seems to be FOSS as well since it's on F-Droid[0] and I hear it has good support from migration from one phone/ROM to another.

[0] https://f-droid.org/en/packages/org.shadowice.flocke.andotp/

View on HN

Mine is aegis.. it's on f droid, completely open source, let's you backup your secrets so changing phones isn't a pita

Seconding Aegis, it's great.

andOTP does all of that too and was out before Aegis. What does it have over andOTP?

AndOTP is really nice. It is the one thing I miss on iOS. On iOS there does not seem to be any totp apps that can just export their db as an encrypted file (or unencrypted if you so choose). So in Apple land I’m stuck with MS Authenticator, coincidentally my only app that needs iCloud (I really want it backed up).

Raivo is an iOS TOTP authenticator that is open source and supports exports. Hopefully, this is what you're looking for:

https://apps.apple.com/us/app/raivo-otp/id1459042137

https://github.com/raivo-otp/ios-application

To add something about this app, I know that people understand “open source” to mean different things. In the case of Raivo, the app is a “source available” one. It’s not FOSS.

The license [1] says:

> Modification, duplication or distribution of this Service (in source and binary forms) for any purpose is strictly prohibited.

[1]: https://github.com/raivo-otp/ios-application/blob/master/LIC...

You're 100% right. Raivo is source-available, but not free (libre) or open source. I found it through a forum post and neglected to check the license.

FWIW, iOS 15 lets you put a TOTP secret right into the saved password entry on your phone, and it will autofill the code just like it autofills your password.

Will I be able to export? When I moved to iOS, AndOTP saved me because I could copy paste all personal keys from AndOTP to MS authenticator. This will probably lock me in…

On iOS each password item in Settings.app has a "Share" button that lets you AirDrop to another device. I don't see another way to export from iOS.

Safari on macOS (at least in Monterey) offers a bulk export option, which can export all your passwords to an unencrypted CSV file. The information includes URL, username/email, password, and an "OTPAuth" column. For GitHub (the only account I've enabled native TOTP for while the feature is still in beta) the entry in that column looks like this:

> otpauth://totp/github.com:<username>?secret=<secret>&issuer=github.com&algorithm=SHA1&digits=6&period=30

So I'm not sure if that would be directly importable to another service, but at the very least you get the secret and so could transfer the data account-by-account if you had to.

given Apple's new spying stance I'm not sure I want to allow the to store my passwords

May not make a difference if you don’t take Apple at their word but iCloud Keychain is among the services/data encrypted end-to-end[1] and there’s no exception mentioned for iCloud backup (like there is for Messages).

[1]: https://support.apple.com/en-us/HT202303

There is Tofu. It doesn't export, but it does back up to iCloud, fwiw.

https://www.tofuauth.com/

My favorite is Android Token because it's only 67 kb and it has everything including qrcode scanning :) check it on fdroid

Reply on news.ycombinator.com