Hacker News Reader

Comment by heipei | Hacker News Reader

I don't get why anyone would use Google Authenticator over Authy which had device sync, backup and E2E encryption for years.

View on HN

Microsoft Authenticator has backup options but doesn't indicate if there is encryption which is concerning.

https://support.microsoft.com/en-us/account-billing/back-up-...

Also I burned myself by activating backups in the app and not realizing I had to activate it in system settings in iOS too (or something to that effect).

So I lost my 2-factors, luckily I had spares for most.

Doesn't Authy require a phone number? I don't know why you'd use Authy over something open source.

Yep they do, and I don't get it either. I deleted Authy a long time ago and switched to Aegis. No regrets.

I need to do this. I’m highly suss of Authy holding my phone number given it’s owned by Twilio. It just doesn’t feel right.

Google Authenticator is still virtually useless because Google routinely locks people out of their accounts with absolutely no recourse.

Because they use the Google ecosystem and don't want to deal with yet one more account with yet one more company. Easier to keep things in one place.

People shouldn't use Authy either due to the fact that they require a phone number.

I and I'm sure many others should rely on open source alternatives. Here's two examples:

Aegis (Android): https://getaegis.app Tofu (iOS): https://tofuauth.com

Another happy Aegis user here adding my support for using it over alternatives.

How is authy end to end encrypted?

My understanding is they encrypt your database with a password before syncing to the cloud. They don't sync the password and there's no recovery.

Reply on news.ycombinator.com