3 ms·

I’d recommend a non-Google 2FA app. Microsoft has one, and Authy is popular. Personally I’m happy with OTP Auth. Some password managers can also handle 2FA, e.g

I’d recommend a non-Google 2FA app. Microsoft has one, and Authy is popular. Personally I’m happy with OTP Auth. Some password managers can also handle 2FA, e.g. Strongbox.

noicebrewery 5y ago
I'd recommend andOTP here as it is open source and not tied to any company that's trying to sell you anything.
- commoner 5y ago
  Seconding andOTP[1] or Aegis,[2] if you're looking for an Android app that only handles OTP authentication. Both of these apps allow file-based import/export so that you can back up your codes and restore them elsewhere, no proprietary cloud service needed. [1] https://github.com/andOTP/andOTP https://github.com/andOTP/andOTP [2] https://getaegis.app/ https://getaegis.app/ I'm not impressed with Authy's privacy policy, especially this part which mirrors the Google issues:[3] > We use the information we gather from you to monitor for unusual or suspicious activity in your account, to communicate with you about your account, and as additional information that can be used to validate who you are if you need to recover your account or your account has been or may be compromised. Authy also collects and shares more of your private information than most OTP apps:[3] > When you use our app we collect: Your phone number, device information, and email address. > We also share your information with our third party service providers as necessary for them to provide their services to us. We may also have to share your information with third parties if required to do so by law. > Your information will be transferred to the U.S. [3] https://www.twilio.com/legal/privacy/authy https://www.twilio.com/legal/privacy/authy
  - egberts1 5y ago
    FreeOTP, PIN Genie Vault are two OTP authenticator that has zero access to your phone and zero data sent back to them. my fall-back is Microsoft Authenticator.
donalhunt 5y ago
Any particular reason?
- rrrhys 5y ago
  1. In a thread about being locked out of google services because of AI black box, it makes sense to reduce dependence anywhere possible 2. If you get a new device, you need to un-enrol and re-enrol in all 2fa providers with g authenticator - it's a nightmare. Very hard if the old device got fatally dropped in a pool! I know at least with Authy you can carry the tokens to a new device.
  - golem14 5y ago
    I just want to chip in and say that 2. can be helped somewhat by having a second device (maybe old smartphone on wifi) that you export all authenticator keys to. Stick the old phone in a safe and make sure it's still working every so often (2x/year?) This is relatively new - a few years ago Authenticator did not support this. Oh, and make sure before you use the emergency device, time is synced - codes won't work otherwise.
    - rrrhys 5y ago
      > This is relatively new - a few years ago Authenticator did not support this. Thanks, this was around when my device went for a swim.
- kevingadd 5y ago
  Aside from the other reasons cited, at least once in the past Google replaced Authenticator with a new app and I had to re-configure all of my 2FA from scratch to transfer over. Deeply untrustworthy, it's already bad enough having to reconfigure 2FA when I get a new phone without them forcing me to do it again. I use Authy these days. https://android.stackexchange.com/questions/20899/why-does-the-google-authenticator-app-have-obsolete-in-its-title-on-play-store https://android.stackexchange.com/questions/20899/why-does-t...
alanh 5y ago
1Password has had really nice 2FA support for years now

I’d recommend a non-Google 2FA app. Microsoft has one, and Authy is popular. Personally I’m happy with OTP Auth. Some password managers can also handle 2FA, e.g. Strongbox.

noicebrewery 5y ago

I'd recommend andOTP here as it is open source and not tied to any company that's trying to sell you anything.

commoner 5y ago
Seconding andOTP[1] or Aegis,[2] if you're looking for an Android app that only handles OTP authentication. Both of these apps allow file-based import/export so that you can back up your codes and restore them elsewhere, no proprietary cloud service needed. [1] https://github.com/andOTP/andOTP https://github.com/andOTP/andOTP [2] https://getaegis.app/ https://getaegis.app/ I'm not impressed with Authy's privacy policy, especially this part which mirrors the Google issues:[3] > We use the information we gather from you to monitor for unusual or suspicious activity in your account, to communicate with you about your account, and as additional information that can be used to validate who you are if you need to recover your account or your account has been or may be compromised. Authy also collects and shares more of your private information than most OTP apps:[3] > When you use our app we collect: Your phone number, device information, and email address. > We also share your information with our third party service providers as necessary for them to provide their services to us. We may also have to share your information with third parties if required to do so by law. > Your information will be transferred to the U.S. [3] https://www.twilio.com/legal/privacy/authy https://www.twilio.com/legal/privacy/authy
- egberts1 5y ago
  FreeOTP, PIN Genie Vault are two OTP authenticator that has zero access to your phone and zero data sent back to them. my fall-back is Microsoft Authenticator.

donalhunt 5y ago

Any particular reason?

rrrhys 5y ago
1. In a thread about being locked out of google services because of AI black box, it makes sense to reduce dependence anywhere possible 2. If you get a new device, you need to un-enrol and re-enrol in all 2fa providers with g authenticator - it's a nightmare. Very hard if the old device got fatally dropped in a pool! I know at least with Authy you can carry the tokens to a new device.
- golem14 5y ago
  I just want to chip in and say that 2. can be helped somewhat by having a second device (maybe old smartphone on wifi) that you export all authenticator keys to. Stick the old phone in a safe and make sure it's still working every so often (2x/year?) This is relatively new - a few years ago Authenticator did not support this. Oh, and make sure before you use the emergency device, time is synced - codes won't work otherwise.
  - rrrhys 5y ago
    > This is relatively new - a few years ago Authenticator did not support this. Thanks, this was around when my device went for a swim.
kevingadd 5y ago
Aside from the other reasons cited, at least once in the past Google replaced Authenticator with a new app and I had to re-configure all of my 2FA from scratch to transfer over. Deeply untrustworthy, it's already bad enough having to reconfigure 2FA when I get a new phone without them forcing me to do it again. I use Authy these days. https://android.stackexchange.com/questions/20899/why-does-the-google-authenticator-app-have-obsolete-in-its-title-on-play-store https://android.stackexchange.com/questions/20899/why-does-t...

alanh 5y ago

1Password has had really nice 2FA support for years now