Authenticator app advertising on App Store sends QR codes to developer | Hacker News Reader

Authenticator app advertising on App Store sends QR codes to developer

twitter.com

38 pointstech234a19 comments

That's a potentially terrifying breach because your second factor has effectively been permanently backdoored by the app developer without your knowledge. I'm hoping this has been reported and a check for this sort of thing is added to the review process for all MFA apps.

On a related note: security experts of HN which (if any) TOTP authenticator apps would you use/recommend? I currently use duo authenticator except for one thing which bafflingly will only work with google authenticator and not duo (don't ask me why) or things like steam or lastpass which have their own homebaked authentication app. Any reason to use something different?

I should add I have no particular affiliation with duo. I ended up with it because I worked at a place that did the duo push authentication thing as the MFA enterprise SSO. Having installed the app, every time I needed an authenticator it's just what I had and therefore used.

I'm not a security expert, so consider this an anecdote, but I use Bitwarden to store my passwords and TOTP tokens.

I used Authy initially. I then exported all the TOTP tokens out of Authy and imported them into unix pass and Aegis. So on my laptop I just use pass, and on mobile it's Aegis.

I use pass myself. I had no idea you could use it for otp. Are you using something like this? https://github.com/tadfisher/pass-otp

Yes! That's what I use - it's very convenient. The first line of the pass file needs to be the totp string, that's all. But you can also use oathtool at the command line with the secret.

oathtool -b --totp <otp secret>

It doesn't have to be the first line of a password store file, it can be anywhere in the file, as long as it starts with `otpauth://`. You can also just append it using `pass otp append foobar`. There's also a handy app that can read the password store database for both Android and iOS, which also supports OTP.

Oh, didn't know that. Thanks! Which is the app?

I've only used the iOS app, but there's a list of applications and integrations on the website: https://www.passwordstore.org

The app is also handy for bootstrapping OTP, because some implementations only give you the QR-code, not the secret or URI, and then you have to do the dance with decoding the QR-code before adding it.

On Android I've being using FDroid hosted apps like KeepassXC, and for OTP have migrated from andOTP to Aegis within the past ~1 year or so.

Hey, I use the Yubico Authenticator. It (AFAIK) only lets me see the codes if I have my physical yubikey plugged in/connected via NFC. It's basically YubiKey support for Applications/Sites that don't support Hardware Authentication. There is also a Desktop app for Linux, for Windows I am not sure.

That's interesting. THanks. I have a yubikey so that is for sure an option.

I'm reminded of the post the other day about a Chrome extension which requests lots of permissions and there were comments reassuring us that such an extension would never pass review.

It doesn’t seem equivalent. It’s hard to figure out that this app is doing anything fishy without a thorough code review/sniffing external communication. In the extension example, all the permissions are laid out.

Unfortunately it seems like companies like Microsoft are not content with all those free third party apps offering an open, standardized service where really Microsoft should be the gatekeeper. So now they are ‘enhancing’ the system with extra codes being sent, location being checked etc. And of course this advanced security, which can be enforced by just an enticing click in the policy editor, only works with the Microsoft app, on the devices Microsoft allows. And they get to decide who gets updates and who gets to make do with third rate support.

The app also has a $4 weekly subscription, with $40 annual and $60 lifetime options. As of when I wrote this comment, the app can still be found on the App Store.

It was never a good idea to use an internet-connected device with complex software stacks as the 2nd factor. We should go with Yubikeys & Co.

Until hardware security devices support "identical twins" in some way, they're simply too impractical. For them to be practical for all accounts, not just the most sensitive few, you need to be able to have another key stored in a secondary secure location.

Something like: when you enroll your primary, it automatically tells the site about your secondary key. The secondary is protected by a PIN and has equivalent validity as the primary and if it's ever used, the site notifies you. If your primary is lost or stolen, you can use your secondary with the help of your "password" manager to automatically revoke the old primary on all accounts. When you buy a new secondary, the same protocol can be used to inform sites to trust it, after which you put in back in storage.

Ahhhh hahahahaaa…

Your phone will never be a proper secure computer.

Reply on news.ycombinator.com