10 ms·
FreeOTP – An open-source solution for authentication soft tokens
- callahad 9y agoArticle is from 2014, though the project is still minimally active: https://github.com/freeotp/freeotp-android https://github.com/freeotp/freeotp-android
- StavrosK 9y agoFreeOTP is great, unfortunately it's unmaintained. There are so many easy features it could get (e.g. a search box) but nothing is going on.
- akoster 9y agoCheck out Authenticator for iOS. Open source and has builds posted in the App Store https://github.com/mattrubin/Authenticator https://github.com/mattrubin/Authenticator https://itunes.apple.com/us/app/authenticator/id766157276?mt=8 https://itunes.apple.com/us/app/authenticator/id766157276?mt...
- StavrosK 9y agoUnfortunately (because that looks great), I use Android, thank you though.
- 4ad 9y agoFrom the readme: > Secure: All data is stored in encrypted form on the iOS keychain I suppose this means it's using the secure enclave behind the scenes? Is the encrypted data (encrypted with what key?) part of the device iCloud backup?
- ocdtrekkie 9y agoWhen I was on Android, I never saw any reason not to use the open source Google Authenticator version (still available via F-Droid, or relatively easy to compile yourself). It's simple, it's fast, it's open, and it works.
- StavrosK 9y agoHmm, that's a good alternative. Do you have a link to the F-Droid version? I can't seem to find it there. EDIT: It looks like it was taken down because it uses an MD5 signature for the APK.
- iou 9y agoIf that is the reasoning that would be very hipocritical of Google. I know for a fact they use MD5withRSA for some of their own apks including YouTube - https://www.josephkirwin.com/2016/05/05/humbled-by-md5/ https://www.josephkirwin.com/2016/05/05/humbled-by-md5/ * at least they did at the time that was written.
- klyubin 9y agoMD5 APK signatures are still supported by Android and are accepted by Google Play when you upload an APK there. See https://forum.f-droid.org/t/many-old-unmaintained-apps-have-been-archived/670/18 https://forum.f-droid.org/t/many-old-unmaintained-apps-have-... for more discussion about this in the context of F-Droid. I believe F-Droid was (is) using Oracle jarsigner to verify APK signatures and this is what causing F-Droid to reject APKs with MD5 signatures.
- iou 9y agoAs a current contributor, I know that's just not true https://github.com/freeotp/freeotp-android/commits/master https://github.com/freeotp/freeotp-android/commits/master If a search box is desirable I'd recommend upvoting an existing feature request on there or submitting a PR for that if you're an android developer too.
- gareim 9y agoCould you guys push an update to the App Store please? The current version is 3 years behind. I also thought the project was unmaintained until just now.
- another-dave 9y agoAlso, the first link in the article points to https://fedorahosted.org/freeotp/ https://fedorahosted.org/freeotp/ but is redirected to a retirement message: > fedorahosted.org was retired on March 1st, 2017. If you are viewing this page, odds are it's after that date and you have been redirected here by attempting to go to some project on fedorahosted.org. Further down the page it says [if you are a maintainer]: > We are also happy to setup redirects for your project to a new location. Just file a issue in https://pagure.io/fedora-infrastructure https://pagure.io/fedora-infrastructure and we will try and help you out. Know nothing about FreeOTP (though sounds interesting!), but my first impressions was also that it probably isn't active, given they haven't decided to set-up a 301 to the new project home. (EDIT: Typo 'pointa' -> 'points')
- StavrosK 9y agoI'm glad to hear that, but I don't know how valid your assertion is when scrolling just a bit down the first page brings up commits from 2014. I went to file/upvote the search box issue a few weeks ago, and the 71 open issues weren't encouraging. Then, I figured I'd learn Android development and submit a PR, but saw 15 open ones from years ago and figured the project was unlikely to ever merge my PR and just left. In my defense, those signs don't scream "maintained project" to me.
- bonzini 9y agoIt is maintained by Red Hat (and it's the suggested OTP soft token for RH employees).
- wyager 9y agoI’ve been using FreeOTP for TOTP tokens for the last few years. No issues. I wish it had the ability to export tokens, although I can see why they practically wouldn’t want to give that ability to clueless end-users.
- StavrosK 9y agoIf you're rooted, I use Titanium Backup for that.
- FuckOffNeemo 9y agoI use to use TB for everything but, new corporate requirements mean I can no longer run a rooted phone. Less I use a second phone for work specifically but I have no desire to carry two around with me. Haven't been able to find a way around of backing up my tokens. Though admittedly the use case is small anyway, the backups are only valid for the device that the backups are from. Though this is by design, of course.
- StavrosK 9y agoActually, someone posted a very good solution above: https://play.google.com/store/apps/details?id=org.shadowice.flocke.andotp https://play.google.com/store/apps/details?id=org.shadowice.... It allows backing up to GPG encrypted files, and seems great overall. It's my new TOTP client of choice.
- FuckOffNeemo 9y agoThat's awesome, thanks! I'll give it a go.
- shaan7 9y agoIt does, this worked for me some time back- adb backup '-f /tmp/freeotp.ab org.fedorahosted.freeotp' (non-rooted Nexus 5X)
- 9y ago
- w8rbt 9y agoIf you prefer command line programs and you like keeping your TOTP secrets PGP encrypted, try goathen: https://github.com/w8rbt/goathgen https://github.com/w8rbt/goathgen
- StavrosK 9y agoHaving the tokens on the computer with the KeePass file feels a bit too close to home for me. I can heartily recommend a YubiKey for those, which plugs in to USB and you can use their very nice TOTP desktop app.
- scrollaway 9y agoYou can always keep the totp in a separate keepassxc database. It's not a separate device but unless your threat involves targeted machine access, it's a separate factor. Keepass2android supports totp as well, and can lock the kdbx secret with the Android secret storage system giving you a little bit of trade-off there if you are interested. Edit, dug up this post of mine which talks about totp strategies among other things. https://news.ycombinator.com/item?id=15421444 https://news.ycombinator.com/item?id=15421444
- StavrosK 9y agoOh huh, I use keepass2android but didn't know it had TOTP support, thank you!
- burner47 9y agoandOTP (Open-source two-factor authentication App) - https://f-droid.org/app/org.shadowice.flocke.andotp https://f-droid.org/app/org.shadowice.flocke.andotp I like this one. Maintained, open source, and you can even have encrypted backups.
- StavrosK 9y agoThis is fantastic, thank you. It has everything I needed, I'm going to see if I can migrate from FreeOTP to this. Thanks again. EDIT: I wrote a short Python script that will migrate your tokens from FreeOTP to andOTP, I have posted it as an issue on the repo: https://github.com/flocke/andOTP/issues/66 https://github.com/flocke/andOTP/issues/66
- zeratax 9y agoIf you're on lineageos, I would make sure you're not affected by this: https://github.com/flocke/andOTP/issues/16 https://github.com/flocke/andOTP/issues/16 Apparently some bug in lineageos causes the app to not save your keys.
- shaan7 9y agoI love FreeOTP because you can then use adb to grab a backup to restore to a new phone.
- aequitas 9y agoHow did you manage to do this. I switched to freeotp for this reason but am unable to make a backup following online instructions. Do I need to have my device rooted?
- y0ghur7_xxx 9y agoadb pull /data/data/org.fedorahosted.freeotp/shared_prefs/tokens.xml tokens.xml
- StavrosK 9y agoSwitch to andOTP, I did it last night and it's much better than FreeOTP (maintained, more features, supports backups natively). You can even migrate easily from FreeOTP using this short script I wrote: https://www.stavros.io/tips/migrate-freeotp-to-andotp/ https://www.stavros.io/tips/migrate-freeotp-to-andotp/
- conorgil145 9y agoI have used FreeOTP, Google Authenticator, Authy, and LastPass Authenticator. Of those options, I use Authy because it is also free and has hands down the best UX. However, I think that current solutions for soft token two factor authentication (2FA) generally do not provide a good user experience for end users. When trying to login and get work done, it is frustrating that the typical 2FA login flow requires a context switch to a completely different device, especially one that will likely distract you with non-work related notifications and content. That is why I am working on a project called Two Factor Buddy (2FB), which integrates directly with the browser to automate the entry of 2FA codes during the login process with all of your favorite third party services (e.g. Github, Google, AWS, Stripe, etc). This means you can maintain the 2FA level of security on your accounts and get to work more quickly. If 2FB sounds interesting, check out a short screencast of what the login flow looks like using 2FB [1] and add yourself to the email list [2] if you want to get notified when you can try it out. [1] https://drive.google.com/open?id=0BxEuMs2jIxWfVDlMTmRHTExQSGs https://drive.google.com/open?id=0BxEuMs2jIxWfVDlMTmRHTExQSG... [2] http://eepurl.com/c7OBwj http://eepurl.com/c7OBwj
- directionless 9y agoFWIW These days 1password supports TOTP directly, pretty smooth in the browser.
- conorgil145 9y ago1passowrd has a good blog post explaining why using 1password for TOTP is not 2FA [1]. If someone gets into your password vault, then they have both authentication factors: your passwords (what you know) and your 2FA secrets (theoretically, what you have). [1] https://blog.agilebits.com/2015/01/26/totp-for-1password-users/ https://blog.agilebits.com/2015/01/26/totp-for-1password-use...
- ocdtrekkie 9y agoThe main issue I have with Authy is caused by their apparent efforts to convince websites to implement two-factor authentication in such a way that it exclusively works with Authy, despite offering no advantages over TOTP. (My understanding is that the API effectively creates a TOTP token, which if you can intercept, can be used in a normal TOTP client.) Cloudflare used this for years, and Humble Bundle uses it right now. It is hard to understand why this is a thing if Authy is not paying companies to restrict a critical security feature to users of their app.
- slim 9y agoAlso freeOTP is 400k in size. I love tiny apps
- advisedwang 9y agoOTPs suffer from being phished. If you accidentally log in to a phishing site, you would still type in an OTP when prompted, which the phishing site can pass along. While this does only give one time access, that can still do a huge amount of damage. Solutions like U2F create credentials that are specific to the site you are currently on, enforced by the software. So the credential sent to www.goeglo.com isn't valid for www.google.com, and so foils phishing much more completely.
- nodesocket 9y agoDoes anybody know how to transfer Google Authenticator entries on iOS? Getting an iPhone X soon and redoing all 2fa services is horrible and makes me cry.
- esseti 9y agoauthy has backups. check if it can also import from google authenticator..
- bubblethink 9y agopretty sure that would be a security disaster if apps could read other apps' storage. So no, no other app can import it unless a) the app exports it or b) you have root. Also, authy, duo and the like are proprietary apps with a lock-in model. No free clients, no documented protocol. Usually they just tack on some server side functionality for notifications etc. on top of TOTP.
- kej 9y agoIt won't help you this time, but next time print out each QR code and save them in a secure place. Setting up a new device becomes much easier.
- stephenr 9y agoOn iOS (and beta for macOS) I can't recommend OTP Auth[1] highly enough. It does one thing and does it well. For a business/team case (i.e. if an account must be shared) I'd probably stick to Pass[2] with the OTP plugin[3] but for 99% of use cases, OTP Auth wins hands down. 1: http://cooperrs.de/otpauth.html http://cooperrs.de/otpauth.html 2: https://www.passwordstore.org https://www.passwordstore.org 3: https://github.com/tadfisher/pass-otp#readme https://github.com/tadfisher/pass-otp#readme
- 4ad 9y agoDoes it use the secure enclave? Probably not, as it boasts iCloud sync.
- hobarrera 9y agoThere's also _totp-cli_, which also uses _pass_ as a backend. The big difference is mostly that _totp-cli_ uses a more human-friendly interface, rather than requiring machine-friendly input. It also predates pass's support for plugins. https://github.com/WhyNotHugo/totp-cli https://github.com/WhyNotHugo/totp-cli
- dndneux 9y agoI think storing TOTP secrets on a YubiKey is the most secure option, since the secrets can't be extracted from the device. See https://developers.yubico.com/OATH/YubiKey_OATH_software.html https://developers.yubico.com/OATH/YubiKey_OATH_software.htm... for the software needed for usage.
- 4ad 9y agoI'm a little bit confused about these applications' security model. Normally I'd want whatever secrets are kept by these apps never to leak in the iCloud backups (secure enclave storage? I don't know). Do they do this or do they do something else? I see that some apps boast about iCloud integration. That is certainly something I don't want. But for the others that don't have iCloud integration, isn't the secure data backed in iCloud as part of the (daily?) device backup? Also, if they don't have iCloud integration, how do you switch devices? Thanks!
- mfreeman 9y agoObsidian for iOS and MacOS has probably the best UI and usability.
- wvh 9y agoI don't know if there are many Jolla/Sailfish users here, but SailOTP works well for standard TOPT/HOTP authentication. I think at the moment it's the only non-default app I have installed on my phone.
- mm4 9y agoI think software token that you setup with qr or password from page is still "something you know (but it was too long to remember)", not "something you have (like a private key that that was generated on and never left your security key)"
- fergbrain 9y agoIs there a good solution for a hardware-based TOTP, similar to RSA SecurID but for HMAC TOTP (RFC 4226) instead?
- StavrosK 9y agoYes, a Yubikey.
- fergbrain 9y agoYubiKey isn’t self contained. I was asking about a hardware-based device that has a built-in display (like SecurID does).
- StavrosK 9y agoOh, I see, I thought SecurID were just USB HSMs. I'm not aware of one, I'm afraid. Why do you need that much security (and why is a phone not good enough)? Ideally, we'll all move to U2F soon.
- fergbrain 9y agoI would like my “thing I have” to be physically separate from the device that stores my “thing I know.” I also don’t always have access to a USB port (or NFC).
- StavrosK 9y agoHm I see. I don't know any such device, I'm afraid. I only use my phone/Yubikey. It's not hard to make one, if you're so inclined (TOTP is a pretty easy protocol), and I'm sure someone will be selling one already.
- INTPenis 9y agoWith so many other recommendations in this thread I thought I'd say that I've used FreeOTP for several years now. Currently I have 10 "keys" in it that I use daily. Never an issue and I enjoy using an open source product backed by my favorite company, RedHat.
- StavrosK 9y agoI've used it for years with 25+ keys, and it gets a bit unwieldy. The main problem is that the only sorting mechanism is manual, so I can't sort by last used, or search the keys by name, so I keep having to read the entire list every time to find the key I want. Other than that, it does what it says on the tin.
- IgorPartola 9y agoMy problem with GA has always been that when you get a new device, you have to have a manual process to transfer your setup to it. Yes it’s more secure. Yes it sucks. I recently switched to Authenticator Plus, which is commercial, because it has iCloud backup. The seeds are locally encrypted before they hit the server. To me this is an acceptable trade off for not being locked out of my accounts if I lose my phone (no, not everyone has sane backup methods and SMS isn’t secure). Does FreeOTP have this feature? I can’t tell.
- wadkar 9y ago2014 - the title could use an update. Also, long time user here. Thanks for keeping the FreeOTP app updated and working!
- hobarrera 9y agoThe lack of backup/export is the killer for me. When resetting the phone, or moving to a new iPhone, there's no way to carry over settings. The same applies if you have more than one device. If you ever have any issues, you'll lose all your OTP keys.