8 ms·

AndOTP: Open-source two-factor authentication for Android

108 points by xrisk 7y ago

edent 7y ago
I use this extensively. Took a little while to swap all my codes from Authy - but well worth it. Simple app, encrypted backups, and open source. What's not to like?
naranja 7y ago
I still prefer the much simpler FreeOTP+. Just start, tap and go. Can be easily backed up and restored: either via Import/Export or plain Titanium Backup.
snvzz 7y ago
I have used this for years. I don't know a better solution.
gravitas 7y ago
A little bit ago in another HN article (https://news.ycombinator.com/item?id=20232164 https://news.ycombinator.com/item?id=20232164) where AndOTP popped up, a link was shared with a nice discourse between the AndOTP author and a newer one, Aegis: https://old.reddit.com/r/androidapps/comments/b45zrj/dev_aegis_authenticator_secure_two_factor/ej4dfzw/ https://old.reddit.com/r/androidapps/comments/b45zrj/dev_aeg... AndOTP isn't seeing a lot of development, but Aegis is moving like gangbusters and recently passed the 1.0 mark. Thanks to that HN trail of info, I've switched from AndOTP to Aegis: https://github.com/beemdevelopment/Aegis https://github.com/beemdevelopment/Aegis The Aegis devs have been doing a bang up job and the app is worth a look, it can import your AndOTP (and other apps) data. This is not a slight against AndOTP, just what I personally see as a natural progression based on that reddit thread above.
- deleted 7y ago
  [deleted]
- gopkarthik 7y ago
  Thank you for this recommendation. Just tried Aegis on Android: 1. Its UX is more polished than andOTP; the AMOLED theme in particular is well done. 2. It also supports fingerprint unlocking, the lack of which was the biggest pain point when regularly using andOTP. 3. Supports imports from popular 2FA apps, though this requires root access. A few issues I noticed: 1. While importing from andOTP, the issuer is blank when the 2FA token was manually added to andOTP. So now I have a list of 2FA codes with no indication as to which website they belong to. [Screenshot](https://gopi.dev/images/aegis.jpg https://gopi.dev/images/aegis.jpg) 2. The 'Vault is unlocked' notification persists even on closing the app. 3. OpenPGP integration for backups isn't available.
  - alexbakker 7y ago
    One of the Aegis developers here. Thanks for the feedback. Could you create an issue on GitHub for #2? I'm curious to know if you killed the app or just minimized it.
    - gopkarthik 7y ago
      Ah my bad, looks like it only happens when I kill the app and not when I exit the app properly. I do not know if android apps are supposed to clean up persistent notifications when they are killed or even if they can.
  - gravitas 7y ago
    For issue #1 - try going into settings and enabling Account Name, I believe it's off by default. I, like you, had to edit each entry after import; Aegis has multiple metadata fields and I think the old data imports into the (not visible) Account field if I recall my experience correctly.
    - abrowne 7y ago
      This (issuer saved in account name field) is what I got when I just imported my andOTP data. If you long-press and edit an entry, you can see and change both fields.
NilsIRL 7y ago
Here are some alternatives: * FreeOTP https://github.com/freeotp/freeotp-android https://github.com/freeotp/freeotp-android * FreeOTP+ https://github.com/helloworld1/FreeOTPPlus https://github.com/helloworld1/FreeOTPPlus * Password Store[3] (pass[4]) supports pass-otp[5] 3: https://github.com/zeapo/Android-Password-Store https://github.com/zeapo/Android-Password-Store 4: https://www.passwordstore.org/ https://www.passwordstore.org/ 5: https://github.com/tadfisher/pass-otp https://github.com/tadfisher/pass-otp
- discreditable 7y ago
  I switched from freeotp when they dropped the ability to backup the secrets database.
- aloisdg 7y ago
  FreeOTP user here. Everything works as expected.
- graton 7y ago
  FreeOTP hasn't had a commit since Dec 14, 2017, according to the GitHub repo. Also Android 10 gave a warning when I ran it. That is was developed for an older version of Android.
  - boring_twenties 7y ago
    > FreeOTP hasn't had a commit since Dec 14, 2017 Why is this seen as a necessarily bad thing? Neither the requirements nor the TOTP protocol has changed since then.
    - graton 7y ago
      Well it hasn't been updated for Android 10. Android 10 gives a warning the first time you run it. Not a positive thing.
      - boring_twenties 7y ago
coderobe 7y ago
Been using AndOTP for months and i love that it supports android's keystore and device credentials for authentication. I had switched to it from Authy, which was quite heavy. Aegis' design looks a lot less dense than AndOTP on the screenshots, though it seems to be widely recommended. I'll have to check what that's all about
- gravitas 7y ago
  The density is configurable in Aegis, 3 "View Modes" - Normal (what you see by default I think?), Compact and Small. You can then choose to show or hide the Account name to further reduce size, and it supports Groups to organize.
8K832d7tNmiQ 7y ago
I used to use this app frequently until my workspace required me to switch to iOS. I need to manually set all my OTPs to OTP Auth due to its backup incompactibility. Does anyone knows a way to do that?
- StavrosK 7y ago
  You can export your keys to JSON from andOTP, I'm not sure if there's import functionality in the iOS app, though.
dastx 7y ago
Is there a reason people don't use their password manager for OTP? In my case I'm using 1Password, which supports OTP but I know most other password managers support it too including clients for Keepass. I guess there is the issue of your password manager being compromised but honestly I'm way less worried about that than website x or y getting compromised.
- etiennemarcel 7y ago
  I used to do that for the convenience of the autofill but my paranoia got the best of me. If someone got access to my 1password he could access all my accounts, which defeats the purpose of two factor authentication. It turns out that with the shared copy/paste feature between Mac and iOS, using a phone app isn't such a hassle.
  - fernandotakai 7y ago
    i totally agree. at the same time, my phone has ~15 2FA accounts right now. if lose my phone, i can't access any of them. if i change my phone, it will take me hours and hours to change every single one of those accounts. there must be a middle ground between those two.
    - socceroos 7y ago
      Export your 2FA from Aegis and import into new phone. That's the main reason I switched.
- zokier 7y ago
  It isn't much of a second factor if it is the same factor as your password.
  - dastx 7y ago
    But the point it protects against is if a website a password belongs to is compromised. If your password manager is compromised, then yes, it is game over. But by that logic, if your password manager and your otp manager is compromised (which often live on the same phone) you haven't mitigated much.
nkootstra 7y ago
Another alternative is: https://github.com/tijme/raivo https://github.com/tijme/raivo Unfortunately it's only for iOS
rlvesco7 7y ago
The best AndOTP feature for me is the fact that it integrates with OpenKeyChain thus allowing the use of PGP keys for backups. I also wish there were more apps that use OpenKeyChain. For example something that allowed notetaking.
shmerl 7y ago
Yep, it's pretty good. For regular Linux I can also recommend oathtool: https://www.nongnu.org/oath-toolkit/ https://www.nongnu.org/oath-toolkit/
ggm 7y ago
Being able to move without having to hold Q/R codes is good. I have to maintain PGP encoded (and keystore held) images of screengrabs of Q/R codes because very few of the OTP out there want to acknowledge you might want to move a 2FA to another system. These are not secrets which have to stay locked in one cupboard. They are secrets which might stay locked in several cupboards: I have two phones. Is it not sensible to share the Q/R initialized state amongst them?
pkstn 7y ago
Also try https://avain.app https://avain.app

108 points by xrisk 7y ago

I use this extensively. Took a little while to swap all my codes from Authy - but well worth it. Simple app, encrypted backups, and open source. What's not to like?

naranja 7y ago

I still prefer the much simpler FreeOTP+. Just start, tap and go. Can be easily backed up and restored: either via Import/Export or plain Titanium Backup.

snvzz 7y ago

I have used this for years. I don't know a better solution.

gravitas 7y ago

A little bit ago in another HN article (https://news.ycombinator.com/item?id=20232164 https://news.ycombinator.com/item?id=20232164) where AndOTP popped up, a link was shared with a nice discourse between the AndOTP author and a newer one, Aegis: https://old.reddit.com/r/androidapps/comments/b45zrj/dev_aegis_authenticator_secure_two_factor/ej4dfzw/ https://old.reddit.com/r/androidapps/comments/b45zrj/dev_aeg... AndOTP isn't seeing a lot of development, but Aegis is moving like gangbusters and recently passed the 1.0 mark. Thanks to that HN trail of info, I've switched from AndOTP to Aegis: https://github.com/beemdevelopment/Aegis https://github.com/beemdevelopment/Aegis The Aegis devs have been doing a bang up job and the app is worth a look, it can import your AndOTP (and other apps) data. This is not a slight against AndOTP, just what I personally see as a natural progression based on that reddit thread above.

deleted 7y ago
[deleted]
gopkarthik 7y ago
Thank you for this recommendation. Just tried Aegis on Android: 1. Its UX is more polished than andOTP; the AMOLED theme in particular is well done. 2. It also supports fingerprint unlocking, the lack of which was the biggest pain point when regularly using andOTP. 3. Supports imports from popular 2FA apps, though this requires root access. A few issues I noticed: 1. While importing from andOTP, the issuer is blank when the 2FA token was manually added to andOTP. So now I have a list of 2FA codes with no indication as to which website they belong to. [Screenshot](https://gopi.dev/images/aegis.jpg https://gopi.dev/images/aegis.jpg) 2. The 'Vault is unlocked' notification persists even on closing the app. 3. OpenPGP integration for backups isn't available.
- alexbakker 7y ago
  One of the Aegis developers here. Thanks for the feedback. Could you create an issue on GitHub for #2? I'm curious to know if you killed the app or just minimized it.
  - gopkarthik 7y ago
    Ah my bad, looks like it only happens when I kill the app and not when I exit the app properly. I do not know if android apps are supposed to clean up persistent notifications when they are killed or even if they can.
- gravitas 7y ago
  For issue #1 - try going into settings and enabling Account Name, I believe it's off by default. I, like you, had to edit each entry after import; Aegis has multiple metadata fields and I think the old data imports into the (not visible) Account field if I recall my experience correctly.
  - abrowne 7y ago
    This (issuer saved in account name field) is what I got when I just imported my andOTP data. If you long-press and edit an entry, you can see and change both fields.

NilsIRL 7y ago

Here are some alternatives: * FreeOTP https://github.com/freeotp/freeotp-android https://github.com/freeotp/freeotp-android * FreeOTP+ https://github.com/helloworld1/FreeOTPPlus https://github.com/helloworld1/FreeOTPPlus * Password Store[3] (pass[4]) supports pass-otp[5] 3: https://github.com/zeapo/Android-Password-Store https://github.com/zeapo/Android-Password-Store 4: https://www.passwordstore.org/ https://www.passwordstore.org/ 5: https://github.com/tadfisher/pass-otp https://github.com/tadfisher/pass-otp

discreditable 7y ago
I switched from freeotp when they dropped the ability to backup the secrets database.
aloisdg 7y ago
FreeOTP user here. Everything works as expected.
graton 7y ago
FreeOTP hasn't had a commit since Dec 14, 2017, according to the GitHub repo. Also Android 10 gave a warning when I ran it. That is was developed for an older version of Android.
- boring_twenties 7y ago
  > FreeOTP hasn't had a commit since Dec 14, 2017 Why is this seen as a necessarily bad thing? Neither the requirements nor the TOTP protocol has changed since then.
  - graton 7y ago
    Well it hasn't been updated for Android 10. Android 10 gives a warning the first time you run it. Not a positive thing.
    - boring_twenties 7y ago

coderobe 7y ago

Been using AndOTP for months and i love that it supports android's keystore and device credentials for authentication. I had switched to it from Authy, which was quite heavy. Aegis' design looks a lot less dense than AndOTP on the screenshots, though it seems to be widely recommended. I'll have to check what that's all about

gravitas 7y ago
The density is configurable in Aegis, 3 "View Modes" - Normal (what you see by default I think?), Compact and Small. You can then choose to show or hide the Account name to further reduce size, and it supports Groups to organize.

8K832d7tNmiQ 7y ago

I used to use this app frequently until my workspace required me to switch to iOS. I need to manually set all my OTPs to OTP Auth due to its backup incompactibility. Does anyone knows a way to do that?

StavrosK 7y ago
You can export your keys to JSON from andOTP, I'm not sure if there's import functionality in the iOS app, though.

dastx 7y ago

Is there a reason people don't use their password manager for OTP? In my case I'm using 1Password, which supports OTP but I know most other password managers support it too including clients for Keepass. I guess there is the issue of your password manager being compromised but honestly I'm way less worried about that than website x or y getting compromised.

etiennemarcel 7y ago
I used to do that for the convenience of the autofill but my paranoia got the best of me. If someone got access to my 1password he could access all my accounts, which defeats the purpose of two factor authentication. It turns out that with the shared copy/paste feature between Mac and iOS, using a phone app isn't such a hassle.
- fernandotakai 7y ago
  i totally agree. at the same time, my phone has ~15 2FA accounts right now. if lose my phone, i can't access any of them. if i change my phone, it will take me hours and hours to change every single one of those accounts. there must be a middle ground between those two.
  - socceroos 7y ago
    Export your 2FA from Aegis and import into new phone. That's the main reason I switched.
zokier 7y ago
It isn't much of a second factor if it is the same factor as your password.
- dastx 7y ago
  But the point it protects against is if a website a password belongs to is compromised. If your password manager is compromised, then yes, it is game over. But by that logic, if your password manager and your otp manager is compromised (which often live on the same phone) you haven't mitigated much.

nkootstra 7y ago

Another alternative is: https://github.com/tijme/raivo https://github.com/tijme/raivo Unfortunately it's only for iOS

rlvesco7 7y ago

The best AndOTP feature for me is the fact that it integrates with OpenKeyChain thus allowing the use of PGP keys for backups. I also wish there were more apps that use OpenKeyChain. For example something that allowed notetaking.

shmerl 7y ago

Yep, it's pretty good. For regular Linux I can also recommend oathtool: https://www.nongnu.org/oath-toolkit/ https://www.nongnu.org/oath-toolkit/

ggm 7y ago

Being able to move without having to hold Q/R codes is good. I have to maintain PGP encoded (and keystore held) images of screengrabs of Q/R codes because very few of the OTP out there want to acknowledge you might want to move a 2FA to another system. These are not secrets which have to stay locked in one cupboard. They are secrets which might stay locked in several cupboards: I have two phones. Is it not sensible to share the Q/R initialized state amongst them?

pkstn 7y ago

Also try https://avain.app https://avain.app