4 ms·

What’s the missing piece compared to Authenticator Plus or Authy? What’d be my actual missing piece would be backups to my own infra, rather than iCloud or any

by 3np 6y ago

What’s the missing piece compared to Authenticator Plus or Authy? What’d be my actual missing piece would be backups to my own infra, rather than iCloud or any other third party.

traceroute66 6y ago
Backups to own infra has already been taken care of years ago. Look at OTP Auth[1] for example. That will make encrypted backups which you can save wherever. [1] https://apps.apple.com/us/app/otp-auth/id659877384 https://apps.apple.com/us/app/otp-auth/id659877384
- njacobs5074 6y ago
  Looks like Authenticator App has a macOS version as well. OTP Auth seems be purely an iOS app. Edit: OTP Auth has a macOS version, too. Separate purchase.
IgorPartola 6y ago
I like Authenticator Plus but I really wish it had a search feature. I have so many damn accounts in there and lots of them don’t have their own icons.
Eric_WVGG 6y ago
The UI of Authy on the Mac is terrible. One of the worst examples of adapting a mobile UI to a mouse+windows interface I’ve ever seen. Also not native. And its iPhone interface isn’t particularly good in the first place. I was desperate for an app like this a couple years ago, but 1Password wound up adding mfa. Regardless, I wish the creators luck, this looks very good! A real “mac-assed app” https://daringfireball.net/linked/2020/03/20/mac-assed-mac-apps https://daringfireball.net/linked/2020/03/20/mac-assed-mac-a...
- rorykoehler 6y ago
  command + a select all shortcut doesn't work on the text search field.
- PufPufPuf 6y ago
  I'm torn about using the password manager for OTP. All the eggs in a single basket. But I've seen some security people recommend it...
PascLeRasc 6y ago
This app doesn’t seem to allow SIM swap attacks like Authy does, so that’s pretty nice.
jrockway 6y ago
To me, backups are something you don't want for 2FA. It just turns your second factor into an unergonomic first factor. What you want is the ability to enroll multiple authenticators. Newer standards like WebAuthn make this trivial -- for accounts I have that support WebAuthn, I have a portable security key on my keychain, a "permanent" key on my workstation, Windows Hello, and FaceID that can all be used to log in. If I lose one of those devices, I just use another method to log in (and revoke that credential, of course!) and it's no problem at all. I think what is killing adoption here is the reliance of so many third-parties on Google Authenticator style OTPs. OTPs are terrible -- you completely lose 2FA if you lose your phone, and OTPs are easily phished. I don't know why it's so popular, whether it's some regulation, or whether people just wrote their 2FA code a decade ago and haven't updated their flow to accommodate newer standards. Whatever the reason, it is just driving people to develop and use cloud-based password managers and OTP syncers like this, and those things aren't helping security. They're giving people a false sense of security; they feel like they are as protected as having a physical token required for all logins to important apps, but without any of the protection. It's less than ideal.
- PufPufPuf 6y ago
  Most services with OTP use "backup codes", which you are supposed to back up securely. Now, what's the difference to backing up the actual OTP "seed" or how is it called -- either by saving the original QR code, or a built-in backup functionality in the authenticator? Back-up codes give you the ability to log in and disable 2FA, which makes them as powerful as the actual authenticator. OTP is bad, as you pointed out, but backing up the seed does not make it worse. I admit I use Aegis because of the backup functionality. (Well, also for the support for Steam...) After using Google Authenticator, losing my phone and having to use backup codes and painfully re-enable 2FA on all my accounts, I realized that using an authenticator with backup is much simpler than the backup codes.
  - jrockway 6y ago
    Yeah, you're right. The backup codes are a big pain, and kill the security of the account. (Like many others, I don't print those out... they're just in my password manager.) OTP backup is no less secure than that, and is a strong usability improvement. Things would be way better if people just implemented WebAuthn, though. It's more secure than OTPs, and it's so transparent and easy to use that people think it's less secure. Passwords and OTPs should go away, and it's only a few lines of Javascript to make them go away. Sigh!
PufPufPuf 6y ago
I use Aegis, that has backup to (encrypted) file, thus you can use own infra.

by 3np 6y ago

What’s the missing piece compared to Authenticator Plus or Authy? What’d be my actual missing piece would be backups to my own infra, rather than iCloud or any other third party.

traceroute66 6y ago

Backups to own infra has already been taken care of years ago. Look at OTP Auth[1] for example. That will make encrypted backups which you can save wherever. [1] https://apps.apple.com/us/app/otp-auth/id659877384 https://apps.apple.com/us/app/otp-auth/id659877384

njacobs5074 6y ago
Looks like Authenticator App has a macOS version as well. OTP Auth seems be purely an iOS app. Edit: OTP Auth has a macOS version, too. Separate purchase.

IgorPartola 6y ago

I like Authenticator Plus but I really wish it had a search feature. I have so many damn accounts in there and lots of them don’t have their own icons.

Eric_WVGG 6y ago

The UI of Authy on the Mac is terrible. One of the worst examples of adapting a mobile UI to a mouse+windows interface I’ve ever seen. Also not native. And its iPhone interface isn’t particularly good in the first place. I was desperate for an app like this a couple years ago, but 1Password wound up adding mfa. Regardless, I wish the creators luck, this looks very good! A real “mac-assed app” https://daringfireball.net/linked/2020/03/20/mac-assed-mac-apps https://daringfireball.net/linked/2020/03/20/mac-assed-mac-a...

rorykoehler 6y ago
command + a select all shortcut doesn't work on the text search field.
PufPufPuf 6y ago
I'm torn about using the password manager for OTP. All the eggs in a single basket. But I've seen some security people recommend it...

PascLeRasc 6y ago

This app doesn’t seem to allow SIM swap attacks like Authy does, so that’s pretty nice.

jrockway 6y ago

To me, backups are something you don't want for 2FA. It just turns your second factor into an unergonomic first factor. What you want is the ability to enroll multiple authenticators. Newer standards like WebAuthn make this trivial -- for accounts I have that support WebAuthn, I have a portable security key on my keychain, a "permanent" key on my workstation, Windows Hello, and FaceID that can all be used to log in. If I lose one of those devices, I just use another method to log in (and revoke that credential, of course!) and it's no problem at all. I think what is killing adoption here is the reliance of so many third-parties on Google Authenticator style OTPs. OTPs are terrible -- you completely lose 2FA if you lose your phone, and OTPs are easily phished. I don't know why it's so popular, whether it's some regulation, or whether people just wrote their 2FA code a decade ago and haven't updated their flow to accommodate newer standards. Whatever the reason, it is just driving people to develop and use cloud-based password managers and OTP syncers like this, and those things aren't helping security. They're giving people a false sense of security; they feel like they are as protected as having a physical token required for all logins to important apps, but without any of the protection. It's less than ideal.

PufPufPuf 6y ago
Most services with OTP use "backup codes", which you are supposed to back up securely. Now, what's the difference to backing up the actual OTP "seed" or how is it called -- either by saving the original QR code, or a built-in backup functionality in the authenticator? Back-up codes give you the ability to log in and disable 2FA, which makes them as powerful as the actual authenticator. OTP is bad, as you pointed out, but backing up the seed does not make it worse. I admit I use Aegis because of the backup functionality. (Well, also for the support for Steam...) After using Google Authenticator, losing my phone and having to use backup codes and painfully re-enable 2FA on all my accounts, I realized that using an authenticator with backup is much simpler than the backup codes.
- jrockway 6y ago
  Yeah, you're right. The backup codes are a big pain, and kill the security of the account. (Like many others, I don't print those out... they're just in my password manager.) OTP backup is no less secure than that, and is a strong usability improvement. Things would be way better if people just implemented WebAuthn, though. It's more secure than OTPs, and it's so transparent and easy to use that people think it's less secure. Passwords and OTPs should go away, and it's only a few lines of Javascript to make them go away. Sigh!

PufPufPuf 6y ago

I use Aegis, that has backup to (encrypted) file, thus you can use own infra.