5 ms·

Afaik, TOTP is standardized, so you should be able to use any authenticator app for 2FA. Idk about Microsoft, but I haven't encountered any service that doesn't

by bogwog 4y ago

Afaik, TOTP is standardized, so you should be able to use any authenticator app for 2FA. Idk about Microsoft, but I haven't encountered any service that doesn't allow you to bring your own TOTP app.

yurishimo 4y ago
I have. I worked for an enterprise that used OneLogin could only use the OneLogin Protect app for 2FA. I thought 1Password was broken but I tried a different app with my phone camera and it said the QR code was invalid.
- stavros 4y ago
  That's configurable in OneLogin, your company just hadn't added more options. I added WebAuthn, Protect and TOTP just this morning.
fenmaz 4y ago
Steam is another big one. They require you to use the Steam mobile app and it's the only way to do 2FA - no QR code. I've since dropped 2FA for Steam altogether.
- boston_clone 4y ago
  This seems to have changed; you're able to use e-mail MFA (and is what I use for my account). Let's just hope they don't use _that_ for marketing purposes! ;)
  - cmeacham98 4y ago
    Actually, that option has existed forever, since even before the app-based MFA. However, if you use the "less secure" email MFA then steam places limits on your account that don't exist with the app MFA, like a forced delay on executing trades.
- ThatPlayer 4y ago
  The Steam 2FA generation has been reverse engineered and you can use it in some password managers. Hardest part is extracting the secret https://bitwarden.com/help/authenticator-keys/#steam-guard-totps https://bitwarden.com/help/authenticator-keys/#steam-guard-t...
  - efreak 4y ago
    "upgrade" steam to version 2.1.4 or older and you can use adb backup. Android backup extractor can convert the backup to a standard tar file.
- efreak 4y ago
  If you've got the steam mobile app for Android for 2fa and want to move to a different app that supports steam 2fa (aegis, winauth, etc), use steam auth on multiple devices, or simply move to a new device without a temporary trade block, version 2.1.4 of the steam app will allow you to perform adb backups; Android backup extractor will allow you to convert the backup to a standard tar file to extract the secrets if you want to.
gabeio 4y ago
Unfortunately, Sendgrid and other users of Authy with no alternative 2FA systems in place lock you into the Authy app or SMS as the fallback. There are some, very limited, workarounds for this but still requires you to have the app in Authy. ——————— On a recent find apparently Authy (the app not the sms fallback) has a weird, uh, “feature?”, where my 2fa, for example, for Sendgrid will unlock all of my Sendgrid accounts, which I personally find mildly concerning.
- 3np 4y ago
  Authy used to just be TOTP IIRC - did that change?
  - vdqtp3 4y ago
    Authy has both TOTP functionality and a proprietary system that's different, similar to Symantec VIP or Entrust
- aftbit 4y ago
  If you load your Sendgrid Authy 2FA on a rooted android phone, you can extract the TOTP secret that powers it under the hood and put it in Bitwarden like you prefer.
Alupis 4y ago
If I wipe my phone, or get a new phone, I still have my phone number and can receive SMS. If I wipe my phone, I have permanently lost all of my TOTP codes if I wasn't careful and backed them up manually before wiping... TOTP is great for security conscious and technologically fluent folks... awful for your grandma.
- danmur 4y ago
  Bitwarden (and probably others) store the TOTP secrets and are persistent. This isn't a recommendation per se, I'm not sure how I feel about it being stored in the cloud, but it is a bit friendlier.
  - Alupis 4y ago
    Sure, but this still requires a certain level of "awareness" for this technology. It's sort of the same problem PGP suffered from. It's technically great, but cumbersome for non-technical people to use (particularly in a safe way), so people will avoid it. 2FA needs to be simple and easy to achieve mass adoption. Making people install special apps for just one service, or find out one day they're permanently locked out of their facebook account (or far worse) is simply going to hurt adoption. If your grandmother can't make it work on her own, then it's not good enough. I'm not advocating SMS is the best option for 2FA, I'm just pointing out the alternatives are currently not up to snuff.
- ByteJockey 4y ago
  TOTP isn't inherently tied to phones.
  - Alupis 4y ago
    No, it's tied to the app because the initial secret is destroyed after you set it up. Every single Authenticator App I've used (which is not all of them admittedly), requires manual backups - typically in some printed form. All of my other apps automatically back themselves up, or Apple/Google backs things up for me. When I get a new phone or wipe my phone... after logging into all my account I fully expect my Authenticator app to show up on my home screen and have all my codes in there exactly as I left it before. This is a huge pitfall for the unaware... you will lose all of your codes, and potentially access to whatever services or things they were protecting.
Spooky23 4y ago
Not in consumer context for sure. Ultimately with any service you’re only protected by your contract and the PR value of a breach of trust. Unless you’re using an open source app and rolling your own sync, an app where trust is paramount (1Password), or one where a misstep is a huge media hit (Apple), you’re at the mercy of that company. Microsoft fwiw, probably uses location to spot fraud and is unlikely to breach user trust imo.

by bogwog 4y ago

Afaik, TOTP is standardized, so you should be able to use any authenticator app for 2FA. Idk about Microsoft, but I haven't encountered any service that doesn't allow you to bring your own TOTP app.

yurishimo 4y ago

I have. I worked for an enterprise that used OneLogin could only use the OneLogin Protect app for 2FA. I thought 1Password was broken but I tried a different app with my phone camera and it said the QR code was invalid.

stavros 4y ago
That's configurable in OneLogin, your company just hadn't added more options. I added WebAuthn, Protect and TOTP just this morning.

fenmaz 4y ago

Steam is another big one. They require you to use the Steam mobile app and it's the only way to do 2FA - no QR code. I've since dropped 2FA for Steam altogether.

boston_clone 4y ago
This seems to have changed; you're able to use e-mail MFA (and is what I use for my account). Let's just hope they don't use _that_ for marketing purposes! ;)
- cmeacham98 4y ago
  Actually, that option has existed forever, since even before the app-based MFA. However, if you use the "less secure" email MFA then steam places limits on your account that don't exist with the app MFA, like a forced delay on executing trades.
ThatPlayer 4y ago
The Steam 2FA generation has been reverse engineered and you can use it in some password managers. Hardest part is extracting the secret https://bitwarden.com/help/authenticator-keys/#steam-guard-totps https://bitwarden.com/help/authenticator-keys/#steam-guard-t...
- efreak 4y ago
  "upgrade" steam to version 2.1.4 or older and you can use adb backup. Android backup extractor can convert the backup to a standard tar file.
efreak 4y ago
If you've got the steam mobile app for Android for 2fa and want to move to a different app that supports steam 2fa (aegis, winauth, etc), use steam auth on multiple devices, or simply move to a new device without a temporary trade block, version 2.1.4 of the steam app will allow you to perform adb backups; Android backup extractor will allow you to convert the backup to a standard tar file to extract the secrets if you want to.

gabeio 4y ago

Unfortunately, Sendgrid and other users of Authy with no alternative 2FA systems in place lock you into the Authy app or SMS as the fallback. There are some, very limited, workarounds for this but still requires you to have the app in Authy. ——————— On a recent find apparently Authy (the app not the sms fallback) has a weird, uh, “feature?”, where my 2fa, for example, for Sendgrid will unlock all of my Sendgrid accounts, which I personally find mildly concerning.

3np 4y ago
Authy used to just be TOTP IIRC - did that change?
- vdqtp3 4y ago
  Authy has both TOTP functionality and a proprietary system that's different, similar to Symantec VIP or Entrust
aftbit 4y ago
If you load your Sendgrid Authy 2FA on a rooted android phone, you can extract the TOTP secret that powers it under the hood and put it in Bitwarden like you prefer.

Alupis 4y ago

If I wipe my phone, or get a new phone, I still have my phone number and can receive SMS. If I wipe my phone, I have permanently lost all of my TOTP codes if I wasn't careful and backed them up manually before wiping... TOTP is great for security conscious and technologically fluent folks... awful for your grandma.

danmur 4y ago
Bitwarden (and probably others) store the TOTP secrets and are persistent. This isn't a recommendation per se, I'm not sure how I feel about it being stored in the cloud, but it is a bit friendlier.
- Alupis 4y ago
  Sure, but this still requires a certain level of "awareness" for this technology. It's sort of the same problem PGP suffered from. It's technically great, but cumbersome for non-technical people to use (particularly in a safe way), so people will avoid it. 2FA needs to be simple and easy to achieve mass adoption. Making people install special apps for just one service, or find out one day they're permanently locked out of their facebook account (or far worse) is simply going to hurt adoption. If your grandmother can't make it work on her own, then it's not good enough. I'm not advocating SMS is the best option for 2FA, I'm just pointing out the alternatives are currently not up to snuff.
ByteJockey 4y ago
TOTP isn't inherently tied to phones.
- Alupis 4y ago
  No, it's tied to the app because the initial secret is destroyed after you set it up. Every single Authenticator App I've used (which is not all of them admittedly), requires manual backups - typically in some printed form. All of my other apps automatically back themselves up, or Apple/Google backs things up for me. When I get a new phone or wipe my phone... after logging into all my account I fully expect my Authenticator app to show up on my home screen and have all my codes in there exactly as I left it before. This is a huge pitfall for the unaware... you will lose all of your codes, and potentially access to whatever services or things they were protecting.

Spooky23 4y ago

Not in consumer context for sure. Ultimately with any service you’re only protected by your contract and the PR value of a breach of trust. Unless you’re using an open source app and rolling your own sync, an app where trust is paramount (1Password), or one where a misstep is a huge media hit (Apple), you’re at the mercy of that company. Microsoft fwiw, probably uses location to spot fraud and is unlikely to breach user trust imo.