Hacker News Reader

Comment by Brajeshwar | Hacker News Reader

If you are not that a hacker but already own a Smartwatch such as the Apple Watch, Authy[1] is a pretty rock solid option. I use Authy for a few key credentials, and I have used my watch for the keys.

FYI, Authy was bought and is now owned by Twilio

1. https://authy.com

View on HN

I use Duo Mobile [1] with my Apple Watch.

Authy gets recommended often here but got turned off of them because they require a phone number to set up the app on iOS. There's no phone number requirement for TOTP implementations so I eventually found Duo Mobile. This was before they got bought by Cisco.

1: https://apps.apple.com/us/app/duo-mobile/id422663827

Ah! I used Authy because it was one of the very early OGs of TOTP Apps.

I use AndOTP on Android. You can export to a PGP-encrypted JSON file so your keys are really your own and not locked into a walled garden like Authy.

AndOTP is great. Especially if you compare it with all the iOS options.

iOS TOTP apps all suck, it's amazingly bad. I installed like ~15 different ones. After the fifth try, I just had to know if it was just my poor initial selection or a general problem.

Each and every iOS TOTP app has at least one crucial problem - requiring a subscription, mandatory sync to a proprietary cloud, having no export-import, not having a watch companion, being from an unknown/generic developer, no support for longer TOTP codes (worse, some display it truncated!) or they're simply very buggy.

I settled on Step Two because it was like all the others, but not an eyesore...

iOS's security makes a self-hosted/non-third party backup/sync super difficult IIRC. (Unless you use Apple's product) I think unless the app has it built in, it's not easily doable. Android can use syncthing, but even Google is making that more and more difficult with each release.

Is there a standard app developers can use to securely sync/backup to for self-hosters? Is there a 'nice' UX/flow to connect apps to s3-style storage (enabling folks to use AWS/DO/Backblaze/whatever?) or would that be too raw?

You're most likely correct about automatic synchronisation from filesystem like that. That though doesn't mean there can't be any built-in integration with Next/OwnCloud or simply manual export-import.

Did you try Ravio OTP? I've seen good things said about it by FOSS people.

https://raivo-otp.com/

Yes. It had no import functionality, no Apple Watch companion, and a relatively convoluted setup process that adds a point of failure without reasonable reduction in any risk.

One would have to set a password that they then store in a password manager, that is then accessed using the same 2FA protected by the password. Plus a mandatory PIN, with the same caveats. Cyclical or duplicate authentication is simply not good design.

I have been using OTP Auth for a while. It doesn't get updated a lot but it's working fine.

https://cooperrs.de/otpauth.html

Aegis is another open-source option. It can import the andOTP format and can also export the keys, but has the advantage of being able to use fingerprint unlock.

AndOTP can use your fingerprint as well. Settings->Authentication->Device Credentials

I also like that Aegis has folders so I can separate my work and personal stuff. Most of the others are just a flat list.

The phone number gets used during account recovery; when I reset my iPhone once without a second Authy device to activate it, I was locked out for 24h while it bombarded my number with calls and texts about the impending restore. I appreciated that safety measure.

And I don't appreciate being forced into a "feature" that specifically subverts the entire god damn point of 2FA codes and leaves them in an unprotected state on some third party server.

Great!

It is, indeed, great to have choices.

(Side note: Authy backups are encrypted client-side with the user's backup password. They're not unprotected on a third-party server; Authy has no ability to decrypt them. https://authy.com/blog/how-the-authy-two-factor-backups-work...)

I apologize for getting that wrong and also want to acknowledge that choice IS good, and I do agree that informed users can reasonably make that decision. I get a bit too "there's one best/right answer" on this topic, thanks for checking me a bit.

The TOTP secrets are encrypted with a passprhase locally. You need the phone number to download the encrypted secrets but then need to use your passphrase to decrypt the restored backup locally.

Ah yes, Twilio, the company that activated 2FA, forced users to activate it during login, and somehow forced it to be SMS auth (aka, completely jamming my account because I dared to login).

Had to manually contact them to resolve and then close the account because FUCK THAT, and fuck SendGrid too, which did the exact same thing after Twilio acquired them.

Sorry, I don't buy for a second that that was an accident or negligence. I'm sick of watching people play ball with companies that pull such moves. (Edit: you want to KYC me to prevent abuse? Fine. Don't make my startup insecure to achieve it.)

Authy is just not a good suggestion here when there are standard, non-needlessly-tied-to-sms options.

There's also Step Two, for iOS, Watch OS and even macOS. I quite like it.

That's what I use as well. Nice apps, fair pricing (One-time payment) and no data collection. Started using it only because of its feature to sync between devices with iCloud - so no more stress if my phone breaks.

Unfortunately it has no import/export functionality and truncates eight/ten-digit TOTP codes. As I mentioned in an another comment, even then it is better than most alternatives on iOS.

For me there’s an export option under „Settings“ ->„iCloud“ ? Or do you mean something different?

I use Authy as well. Best part is it backups your stuff.

That's the feature that got me into Authy. The other feature being it wasn't a google product.

Are those backups E2EE?

Also to be totally honest, each device should have their own TOTP key and while backups are fine*, key sharing isn't.

No. They aren't. This thread is seriously upsetting to read. So many people clearly haven't even remotely begun to think about what they're doing or the implications thereof.

everything I've read suggests that they are, in fact, E2EE

of course, they're not open source, so I'm not really going to bat for them here, but am I missing something?

https://authy.com/blog/how-the-authy-two-factor-backups-work...

https://www.ghacks.net/2022/08/10/twilio-the-company-behind-...

etc.

Another user here pointed out that Authy uses a user provided password to encrypt the 2fa secrets on the server. That's definitely more secure than I had said, that's my mistake. (I still have my reservations, but that's getting too pedantic to matter here)

Key sharing isnt fine but how many web services will let me enroll multiple totp tokens simultaneously? I havent encountered any, personally. yall designed this reality, now you have to live in it.

Reply on news.ycombinator.com