For Android, Aegis. You can get it it on Play, on one of the numerous *-Droid sources or straight from GitHub with Obtanium.
Simple to use, open source, does encrypted exports which I regularly backup (along with Bitwarden and SimpleNotes exports) to one of these (Amazon link). It's perfect for me.
Moved to Raivo earlier this year and it’s great. Unfortunately it was just sold to a private company, so I’m looking for alternatives. From the replies here, might try 2FAs
I recommend KeePass and I encourage everyone to consider it given its platform-agnostic portable format. What happened to Raivo cannot happen to KeePass and its more of a universal solution as opposed to 1) Android: Aegis 2) iOS: Tofu or OTP etc.
All of those are very good apps but the problem remains that they all have their own peculiar/specific format that doesn't necessarily play nice with any other app. KeePass is a convention/format that doesn't really vary between implementations.
Edit: It also allows for choice in whether to keep it local or to safey sync in your choice of cloud service without exposing the contents unencrypted. If you don't want to manage any of that, I would recommend Bitwarden and paying the $10 once and see if you're still fine the next year without having to resubscribe if thats a problem for you.
The problem here would be storing your passwords along with your 2fa. You're basically giving away every information needed to enter your accounts in case someone get access to your vault.
The best option would probably be using both KeePass and BitWarden. You store your passwords in one and your 2fa in the other.
IOS is much harder. Right now, probably "2FAs". Authy is owned by Twilio, Raivo was just bought out by an advertising company, and the others are either too small to get the exposure required for any level of security or charge for the feature.
It's less that Twilio specifically owns it than problems resulting from corporate ownership. Briefly:
You can't get your data out of Authy. Actually you can, but it's a long annoying process involving installing an out of date chrome extension and using developer tools.
Privacy issues. Authy links a lot of data including location to your identity.
Authy supports SMS account recovery (which is inherently insecure) and doesn't allow users to disable it.
I've always been of the mindset that storing your 2fa next to your passwords at least partially defeats the purpose of 2fa.
The two types of attacks I worry about would be a hacked/leaked password from a third party site, or your password manager being compromised. While the latter is far less likely, it is still something I'd like to protect myself from as much as possible.
If my password manager is compromised, I'm well and truly fucked. If one site has shitty security (odds of which are approximately 1), having 2FA might help.
This shouldn't be the case. Using password manager shouldn't mean you only have one password, it should mean you have less password to remember. I use password manager for all the insignificant pages/apps like lemmy, strava, netflix, spotify. If someone hacks them they can cancel my subscription and that's about it. I don't store password for my email, bank or amazon in my password manager.
I hadn't even noticed. With all the mentions of Aegis it looks like I was behind the times. Aegis was able to import my andOTP entries so I'll give it a try.
For ios used to say raivo but i would honestly just make a kdbx file just for your totp seeds only and then use something like keepassium or strong box. I think those allow cloud syncing too but im not sure still keep local backups
Las time I checked those that require a Microsoft or other propietary authenticator app that isn't Google's. They would force you to first use that propietary app and later export to Aegis. Correct me if I'm wrong, of course.
Just checked, you're right about Google. Microsoft does allow you to use any app though. It's funny that the "EEE" Microsoft is less anti-user than the "Don't be evil" Google. But anyway, seeing how Google locks it down, I'm sure there must be others too. So you're right
I was referring to other services requiring specific propietary authenticator apps. Many sites will be compatible with Aegis even if they don't mention apps other than their own in their step-by-step guide.
Have you tried? If it isn't compatible through scan or manual code input the 2FA setup simply won't finish.
Still use Google Authenticator. I know there are alternatives out there that have other features but I'm a pretty strong believer that my 2FA shouldn't be backed up digitally. I keep any recovery information offline and prefer it that way.
These apps are all pretty basic. I don't see any major differences. It's slightly more modern looking, and it checks a lot of boxes for people as far as being simple, open source, and available through multiple channels (Google Play being one). Apparently andOTP hasn't had any updates in a while, but a 2FA app shouldn't need many updates anyway.
For Android, Aegis. You can get it it on Play, on one of the numerous *-Droid sources or straight from GitHub with Obtanium.
Simple to use, open source, does encrypted exports which I regularly backup (along with Bitwarden and SimpleNotes exports) to one of these (Amazon link). It's perfect for me.
Ive got iPhone. Raivo was good until now
Moved to Raivo earlier this year and it’s great. Unfortunately it was just sold to a private company, so I’m looking for alternatives. From the replies here, might try 2FAs
Just started migrating to 2FAS from Raivo and Authy. So far so good.
For Android, I recommend Aegis [Play Store] [F-Droid]
For iOS, I recommend 2FAS [App Store]
For Linux, I recommend OTPClient [Flathub]
For BSD, either try compiling OTPClient from source, or use KeePass.
Aegis for android it's the best , been using it for like 2 years now.
Undoubtedly Aegis for Android, because it has the easiest way to backup your codes. Excellent! And it is open source without internet connection.
Did anyone say Aegis?
I was going to say it but didn't want to be the only one. I do recommend and use it though.
I say Aegis... He he, great app
I recommend KeePass and I encourage everyone to consider it given its platform-agnostic portable format. What happened to Raivo cannot happen to KeePass and its more of a universal solution as opposed to 1) Android: Aegis 2) iOS: Tofu or OTP etc.
All of those are very good apps but the problem remains that they all have their own peculiar/specific format that doesn't necessarily play nice with any other app. KeePass is a convention/format that doesn't really vary between implementations.
Edit: It also allows for choice in whether to keep it local or to safey sync in your choice of cloud service without exposing the contents unencrypted. If you don't want to manage any of that, I would recommend Bitwarden and paying the $10 once and see if you're still fine the next year without having to resubscribe if thats a problem for you.
The problem here would be storing your passwords along with your 2fa. You're basically giving away every information needed to enter your accounts in case someone get access to your vault.
The best option would probably be using both KeePass and BitWarden. You store your passwords in one and your 2fa in the other.
Same. I pair it with KeePassium on iOS.
How can I use KeePassium with 2FA?
Just create an entry and at the bottom setup one time password OTP
Then scan a QR code or enter manually.
Then click the clock to the right of your entry to get the 6 digit code.
Thanks! I will try this. I never knew it existed
No worries. There’s instructions from KeePassium too if it helps.
KeePassXC supports the codes on desktop.
Android is easy, Aegis.
IOS is much harder. Right now, probably "2FAs". Authy is owned by Twilio, Raivo was just bought out by an advertising company, and the others are either too small to get the exposure required for any level of security or charge for the feature.
I'm out of the loop, why is Authy being owned by Twilio a bad thing?
It's less that Twilio specifically owns it than problems resulting from corporate ownership. Briefly:
I appreciate the info, thank you!
Aegeis, like everyone else here lol
I've been using Aegis Authenticator for about two years now . It is free and open-source, and works as expected.
Aegis.
Yubikey authenticator
I use keepassxc for both passwords and 2FA
BitWarden. :)
Then what do you use for your password manager?
I've always been of the mindset that storing your 2fa next to your passwords at least partially defeats the purpose of 2fa.
The two types of attacks I worry about would be a hacked/leaked password from a third party site, or your password manager being compromised. While the latter is far less likely, it is still something I'd like to protect myself from as much as possible.
If my password manager is compromised, I'm well and truly fucked. If one site has shitty security (odds of which are approximately 1), having 2FA might help.
This shouldn't be the case. Using password manager shouldn't mean you only have one password, it should mean you have less password to remember. I use password manager for all the insignificant pages/apps like lemmy, strava, netflix, spotify. If someone hacks them they can cancel my subscription and that's about it. I don't store password for my email, bank or amazon in my password manager.
I'm using BW for both passwords and 2FA and have Yubikey set up for BitWarden.
I've been happy with andOTP on Android.
It's good. Just keep in mind that it hasn't been updated in a while...
I hadn't even noticed. With all the mentions of Aegis it looks like I was behind the times. Aegis was able to import my andOTP entries so I'll give it a try.
2fas. aegis is great but it has no automatic google drive backup.
It does have automatic Android cloud backups and does support local backups, which also supports backing up to Nextcloud.
android cloud backups are unreliable.
They're very reliable from my experience
For ios used to say raivo but i would honestly just make a kdbx file just for your totp seeds only and then use something like keepassium or strong box. I think those allow cloud syncing too but im not sure still keep local backups
I also use authy, curious as to why I had to scroll so far to see it?
Aegis, even if some services won't support it you're better off not supporting those services.
Which services aren't supported?
Las time I checked those that require a Microsoft or other propietary authenticator app that isn't Google's. They would force you to first use that propietary app and later export to Aegis. Correct me if I'm wrong, of course.
Just checked, you're right about Google. Microsoft does allow you to use any app though. It's funny that the "EEE" Microsoft is less anti-user than the "Don't be evil" Google. But anyway, seeing how Google locks it down, I'm sure there must be others too. So you're right
I was referring to other services requiring specific propietary authenticator apps. Many sites will be compatible with Aegis even if they don't mention apps other than their own in their step-by-step guide. Have you tried? If it isn't compatible through scan or manual code input the 2FA setup simply won't finish.
iOS Authenticator Open source no frills 2fa
https://mattrubin.me/authenticator/
2FAS or Ente Auth.
@badgrandpa 2FAS on :android: Not sure if it works on apple products... dont own any to confirm
Still use Google Authenticator. I know there are alternatives out there that have other features but I'm a pretty strong believer that my 2FA shouldn't be backed up digitally. I keep any recovery information offline and prefer it that way.
I've used andOTP and now Aegis (as a result of this thread). Neither require cloud backups.
I've used andotp for like 2 years. Why everyone is suggesting Aegis ? Did you find any major differences?
These apps are all pretty basic. I don't see any major differences. It's slightly more modern looking, and it checks a lot of boxes for people as far as being simple, open source, and available through multiple channels (Google Play being one). Apparently andOTP hasn't had any updates in a while, but a 2FA app shouldn't need many updates anyway.
Things I want in a 2FA app:
andOTP and Aegis both do all of this.
'Zacly..thanks for your help!