Privacy Guides
DescriptionA section dedicated to two-factor authentication (2FA). Potenial software to include could be:
This page could also be used as a template: https://thenewoil.xyz/mfa.html |
Replies: 0 comments 37 replies
|
Authenticator Pro by jmh - seems to be updated constantly , |
|
I would go to Aegis Authenticator. Some time ago @lynn-stephenson looked into this and determined the password encryption was better on Aegis. afaik andOTP uses a heap of rounds of PBKDF2, and when you have a lot of passwords it opens really slowly. |
|
On iOS I usually recommend: "Authenticator" |
|
@dngray I use Aegis and love it! I'll take your word for the use of "Authenitcator" for iOS. |
|
I don't personally have an iOS device, so would rather go with what native iOS users think is best. It just happened to be one authenticator app I know of that was open source. |
|
I would highly recommend Ravio OTP as well |
|
I didn't know this was open source actually. I don't have an iPhone/iOS devices. @danarel are you still using this? |
It is source available but not open-source. Quoting AnonC from Hacker News.
Here's their license page if you want to look at it. https://github.com/raivo-otp/ios-application/blob/master/LICENSE.md#license |
Yeah, it's my daily 2FA for a while now. But yea, worth noting it's not FOSS, but source available. |
|
If there are no other good options, then we might have to recommend this. |
|
Slight typo correction: Raivo OTP is iOS. |
Fixed! This is what I get for copy pasting the same template. |
Agreed. I see no reason and don't understand why someone would use andOTP over Aegis which is a more mature app security-wise with more cryptographically experienced developers and a better and richer UX with more features. Relevant thread: https://www.reddit.com/r/androidapps/comments/b45zrj/dev_aegis_authenticator_secure_two_factor/ej4g6ll/ |
|
I think this is ready to proceed. to a PR now. I think we're pretty much all in agreement. I'd mention Aegis and Ravio OTP as the two options. Regarding the Aegis code, I'm pretty sure @lynn-stephenson looked at the Aegis code in some detail with an audit. They were going to publish their findings, but I'm not sure if they did. |
|
Seems like @lynn-stehpenson committed the report on Aegis v1.1.4 to his repo. |
|
Problem is, that's for version 1.1.4 and the current stable/recommended version (on F-Droid) is 2.0.2.. |
For KeePass its fairly easy to open and use a second database. This is a plus for keepass in OTPs, beside platform interoperability. Or in my case, I use another password manager for passwords, and open a keepass database just for my OTPs. |
|
as for IOS users do we really need to use third-party 2FA app because IOS 15 has now built in 2FA in the password section? |
Yes because it doesn't function as a standalone app. So if I am on my laptop and need my 2FA code, I cannot use iOS 15 to get that code. You need a third party app to manage that. |
|
I haven't tried it myself but can't you view it in the password section? |
|
Technically yes you can go there and get it, but I don't think it's a very user friendly alternative. Anytime you need a code you have to go to Settings > Passwords > the app > authentication code. Also, this means you're storing your passwords and codes with Apple. This same argument would mean the site shouldn't bother offering password managers for iOS because it has one built in as well. The whole point of this site is to offer privacy alternatives away from the tech giants. |
|
What about strongbox? you can also setup there 2FA logins if you want.. my issue with some of these suggested 2FA apps are that they aren't being updated like Authenticator last update is 2019. But as for myself I have been using Authy seems to be getting frequent updates. |
|
In case it's of interest to participants of this discussion, I also opened a thread for hardware 2FA section: https://github.com/privacyguides/privacyguides.org/discussions/156 |
|
Not many people do it this way, but I manage my 2FA with a separate KeePass database. Since each 2FA record is just an entry to kdbx, security is expected to be good with to all the improvements over the years and active participation in the community. Also, I can be sure that my 2FA entries won’t be inaccessible if I move away from one app to another, since there are so many apps for KDBX and basically covers all platforms. One drawback would be the 2FA support depends largely on the app. I’m currently using Keeweb and keepassDX on my phone, both with good support on 2FA. KeepassDX can even show my 2FA codes on the main page, making it on par with other 2FA apps. |
|
Not in favor of this. Passwords should be kept separated from the 2FA tokens. If either the password or 2FA database gets compromised, and you keep them separately, you are still fine. If you put them into the same basket however, you are pretty much screwed. |
|
you can create and open multiple kdbx-es |
|
To include in the Avoid/be aware list, I thought it's beneficial to list a few 2FA/MFA applications that people usually come across first(at least based on what I/my friend(s) have experienced.)
I see these as ones to avoid, but it'd be worth mentioning since the main target of privacyguides.org - ppl rather new/fresh to privacy will have those three in mind(well, at least for me). |
|
Might be worth adding to the list: LastPass Authenticator, and LastPass MFA. Seems like it's used quite a lot on Android, at least judging by the download counts. |
|
Fair to say I think this one is resolved https://www.privacyguides.org/basics/multi-factor-authentication/ |
|
You should add Authenticator Apps criteria. |
Fair to say I think this one is resolved https://www.privacyguides.org/basics/multi-factor-authentication/