Hacker News Reader

Comment by latchkey | Hacker News Reader

After a lot of trouble, I was able to extract my private keys from Authy by installing their deprecated Chrome extension and using some hacky javascript found in a gist. Now, I'm on the search for something else to load my keys into.

All the other 2FA apps out there that I've looked at are lacking in some way or another. Ideally, I'd like as a basis: iOS and MacOS app (not electron) support, easy import/export, no requirement for a phone number, some sort of encrypted 'cloud' backup, open source, decent UX.

I'm half tempted to just import into Bitwarden (which I happily pay for) and call it a day, but I'd like to keep my password manager separate from my 2fa... just seems awkward to combine them.

Bueller? https://www.youtube.com/watch?v=KS6f1MKpLGM

View on HN

Maybe worth looking into getting some Yubikeys (get a spare, it's just easier) and using those in combination with their 2FA app. They can do some other neat tricks as well with SSH and PGP.

Clarification edit: they offer a 2FA token app which you unlock with your hardware key, which is separate and can be used in conjunction with hardware token authentication with any service that offers it.

Note that their cheaper blue or newer biometric keys don't support all the same things their mainline black ones do, but should work just fine.

No affiliation, just happy with their products and had a really awesome (business) customer support experience where they replaced several broken (through my own fault) keys for free.

I use Bitwarden. If someone owns my phone they’ll own all my apps so separating factors isn’t useful to me. I mostly use 2FA in case of a specific bug at a site that allows for something like a password reset attack. I use a FIDO key for the important stuff, including Bitwarden, so I feel like that’s pretty good protection overall. I’ll never be a target of anything more than common criminals, too, never a nation state or anyone looking for crypto or anything.

Just be aware that it might violate your threat model depending on what you're protecting against. There's a benefit to having your second factor also be more or less separated from your password manager, especially for Bitwarden, which doesn't enforce that devices are registered to log in (unlike e.g. 1password does). I say this as a bitwarden user.

Bitwarden's 2FA support is nice because you don't have to jump through hoops to copy out the original secret and use it somewhere else.

It will also automatically put the 2FA code into your clipboard after you autofill your password.

Just to note, extraction works well ( I did the same thing to migrate ) but services with Authy-integrated MFA ( like Twitch ) are "managed" by Authy so it can regenerate the secret on the fly and transparently to the end user, at which point your previously extracted secret will no longer be valid.

This doesn't affect any of the MFA secrets you manually added to Authy, and these days many of the integrated services will let you additionally add standard TOTP mfa to your account ( unfortunately Twitch still requires you to set up an Authy account first, though )

I use one of these open hardware devices: https://www.themooltipass.com/

maybe one day one of these: https://www.crowdsupply.com/sutajio-kosagi/precursor

How does the user experience of these devices compare with Yubikey?

1password is what I use for my mfa keys. It satisfies your needs I think.

Is it still two factor if remote actor can access the second factor with only your master password? (I guess they also need to your email, to verify a new device...)

To add a new device, you need the email address (just the address, not access to the email account), the master password, and the account key. The last one is encouraged to be printed out and kept in a secure, physical location.

This doesn't apply to all password managers, though (unfortunately).

It isn't open source. There have also been numerous complaints about it here after they got VC investment, it seems to have gone down hill.

> …it seems to have gone down hill.

I haven't found anything better. Some people aren't happy with them for reasons like their subscription model and their move to Electron for some formerly-native clients.

> I'm half tempted to just import into Bitwarden and call it a day, but I'd like to keep my password manager separate from my 2fa... just seems awkward to combine them.

FWIW, In practice I find that this is natural and super-convenient.

Reply on news.ycombinator.com