4 ms·
> Authy I don't trust Authy and a discerning security professional shouldn't either. There are _a lot_ of red flags. * First: Forcing users to download their
by exabrial 5y ago
> Authy
I don't trust Authy and a discerning security professional shouldn't either. There are _a lot_ of red flags.
* First: Forcing users to download their stupid app. TOTP is a widely documented protocol. There shouldn't be a need to download a particular app unless there is an ulterior motive.
* Second: secrets are stored in the cloud. Guess what the key to access them is? An SMS. Yes those un-encrypted, un-signed, un-authenticated, spoof-able, forward-able, plain-text, non-guaranteed delivery, MITM ready, message system. Seriously?
* Third: No choice for migrating to another app. Even though Authy has access to your secrets, you cannot export them. There is an ulterior motive here. Authy does not want you leaving them and will play dirty to keep your on their platform.
* Fourth: You will get locked out of everything if Authy decides to pull the plug on you. If you get 'cancelled' for having a non-popular opinion, Authy could revoke access to every single one of your accounts.
Avoid like dysentery.
- dddw 5y agoYes, use aegis instead of authy or google authenticator. Open source and option to export your keys (both encrypted and unencrypted)
- alexaholic 5y agoAren't the keys encrypted with a PIN of your own chosing which you set and verify in the app? -- As a side note, it seems to me that what you call "ulterior motive" is essentially vendor lock-in and I don't think that qualifies as an "ulterior motive".
- Louno 5y agoCouldn't be happier with Raivo OTP on iPhone. Unfortunately it's iOS only but as far as I know it's 100% work of passion and bullshit free app maintained by a single user. Allows to export your entries in a very nice way... which is very securing regarding the kind of data entrusted. No risk of being locked out. Thanks @tijme!
- Louno 5y agoAlso. Whatever app you use, when you set up OTP don't forget to save screenshots of your original qr codes, in a veracrypt container ideally. Don't rely (only) on other people's work and will for such sensitive and personal data.
- tlavoie 5y agoI've never done this, but it seems like an excellent idea. With the QR code, you could always reinstall to a different app.
- esprehn 5y agoWhat's a 2FA tool that meets your requirements?
- exabrial 5y agoAh how timely, Authy outage today. Again: avoid like the plague.