12 ms·
Aegis Authenticator – Secure 2FA App for Android
- thr0wnawaytod4y 4y agoI just put a 2FA implant in my arm
- gchamonlive 4y agoUpdate your threat scenario to encompass dismemberment and create a recovery protocol accordingly. Not sure you would be able to do drills, at least not a second time.
- robertlagrant 4y agoA drill would be a valid vector.
- dexterdog 4y agoThat's why I put mine in my neck. If they cut it out, external access to my accounts is not my main concern.
- gchamonlive 4y agoIf they cut out my arm, that wouldn't be my main concern either
- dexterdog 4y agoBut you would be able to have concerns at least
- gchamonlive 4y agoBy contrast having your neck removed you would have... No concerns at all? So neither your injury nor account access would be in you priority list.
- thr0wnawaytod4y 4y agopeople do not cut off fingers for fingerprints so they wont cut my arm off for my github...
- dexterdog 4y agoThey don't need to cut off your finger to steal your fingerprint
- mnd999 4y agoI’d much prefer having my phone stolen than my arm stolen.
- dexterdog 4y agoYou need to meet every kid I know
- jaimehrubiks 4y agoI prefer to calculate the numbers on paper every time. But you need to do it fast enough to make it in less than 30 seconds.
- thr0wnawaytod4y 4y agoI'm for real tho, it's called the Apex and you load an OTP applet on it
- jaimehrubiks 4y agoReally? How does it work? Is in an NFC implant? Which PC/phone software do you use to read it
- thr0wnawaytod4y 4y agoYes it's an NFC implant. Fidesmo store to load applets, then things like yubico authenticator for OTP. Think of it like only the NFC side of a yubikey neo with fidesmo.
- vzaliva 4y agoBefore considering switching it I would love to see a more detailed feature comparison to `andOTP` I am presently using. From what I can see it is encryption at rest which andOTP may or may not do and scheduled backup. andOTP does manual backup. Anything else?
- ajvs 4y agoandOTP isn't really being maintained anymore, which is why I switched recently.
- mongol 4y agoWho are Beem Development?
- alexbakker 4y agoIt's just a group name for the two guys working on it. Source: I'm one of them (Hi!)
- virtualritz 4y agoThe killer feature for me is a way to quickly access tokens in my (cloud-side, encrypted) vault from a desktop (or web) app in case of emergency. It's not clear to me if Aegis allows this somehow? The other day I broke my phone. I was traveling and needed to do some 2FA level changes to a GH repo asap. I didn't even know there was an Authy desktop app until then. It saved my ass, literally.
- alexbakker 4y agoAegis is fully offline and doesn't have an official desktop application. You could of course create an export of your Aegis vault and import it in a third-party desktop application, like GNOME's Authenticator or OTPClient.
- nashashmi 4y agoTry http://totp.app http://totp.app
- pluc 4y agoYubikeys store everything on the key. I can lose my phone and use your phone to see my 2FA codes. It's honestly one of the only way MFA make sense - otherwise you lock yourself out of your entire digital life when you lose your phone and need to rely on storing your backup codes (which opens up a storage security wormhole). It's also a lot easier to wear around your neck.
- notRobot 4y agoI've been having a great experience with this!
- Sytten 4y agoI am considering switching from authy because it still doesn't have folders or collections or tags but the transition is annoying without root on android. Also wondering how people ensure they can restore if your phone dies?
- Semaphor 4y agoAegis supports automatic backups, I backup my Aegis database encrypted to my nextcloud. edit: Also, it allows (after checking the "I know what I’m doing" warning) plaintext secret export, if you want that for some reason.
- Macha 4y agoAegis at least lets you export a password encrypted backup
- tlaundal 4y agoI did the transition by extracting keys from the desktop app using the scripts mentioned in this gist[1] and its comments. Of course, you should not do this unless you are comfortable verifying the security of the scripts yourself. Importing to Aegis afterwards was quite straight-forward. [1]: https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d958c93 https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d...
- Semaphor 4y agoLast year, 113 comments: https://news.ycombinator.com/item?id=25803996 https://news.ycombinator.com/item?id=25803996
- acdha 4y agoI’ve been migrating away from TOTP since it’s so easily phished but my current approach is to use Yubikeys with their app: https://www.yubico.com/products/yubico-authenticator/ https://www.yubico.com/products/yubico-authenticator/ That avoids keeping the seeds somewhere a general attack could get (and requiring a tap complicates attacks) and works across all of my devices. The main drawback is that there isn’t an easy way to install a seed on multiple keys when first enrolling.
- Semaphor 4y agoI use webauthn where ever available, but considering how rare that is, I might start using this. How well does it work on mobile? Totp via app, tap the nfc key to the phone? And what does "no easy way" mean, how involved is that process? I’d prefer to have the keys on all 3 (or 4, not sure if the security key allows TOTP) sticks.
- RockRobotRock 4y agoYes, on mobile you either plug the YubiKey into your devices USB-C (or lightning) port, or tap the YubiKey to your phone. The totp secrets live on the yubikey and can't be extracted. You can only read out the current code. I believe you can also secure your YubiKey with a password so it must be entered to see the codes. If you wish to have the same TOTPs on multiple YubiKeys, you are recommended to take a screenshot of the QR code you're given at the beginning (which contains the secret key), and manually add it to all the backup keys you prefer, and then securely erase the screenshot. further reading: https://support.yubico.com/hc/en-us/articles/360013789259-Using-Your-YubiKey-with-Authenticator-Codes https://support.yubico.com/hc/en-us/articles/360013789259-Us...
- smeej 4y agoIt's worth noting that if you install Yubico Authenticator on another device and use the same key, you do have access to the codes, because as you said, they're stored on the key. I initially thought the codes were stored on my phone and the key was only required for access, but that's not the case. That's either a benefit or a drawback, depending on your threat model, but it's definitely something people should understand.
- Lucent 4y agoJust keep TOTP in your password manager at this point. Whatever security is lost by it not being a "true second factor" is made up for by not having to recover or restore backups due to a lost or stolen phone.
- Semaphor 4y agoRestoring backups is extremely easy, though.
- arepublicadoceu 4y agoI would argue that the most important account to have TOTP enabled IS your password manager. So, if you already have a TOTP app to generate codes for your Password Manager why not consolidate it? Besides, if you dont have a physical and digital backup of your TOTP seeds you really like to live dangerously.
- howinteresting 4y ago2fa for your password manager is good, but that doesn't have to be TOTP. That can just as well be something like the 1password secret key (something you have).
- plumeria 4y agoI think that's the idea behind using a key file and a password in KeepassXC.
- unethical_ban 4y agoThe one place I intentionally don't have TOTP is my password manager. there is a base case somewhere in a backup strategy where TOTP is not feasible. The base case for me is "Keepass file backed up to multiple locations and my master key written down in an envelope in my house in case I hit my head". Why would I lock my passwords away behind a TOTP that can get lost? My TOTP in Authy is protected by a long random key. Where do I store the key? In my password manager. You can't use a password manager and TOTP to back each other up.
- Semaphor 4y agoAs good a time as any to buy them a beer [0], I have been happily using it for quite some time. [0] https://www.buymeacoffee.com/beemdevelopment https://www.buymeacoffee.com/beemdevelopment
- barbazoo 4y agoI used the one by Twilio but switched my TOTP codes over to 1Password which I was already using anyway. I get that there's a security benefit of not having them in the same app but it's just not practical for me.
- wingmanjd 4y agoI didn't know Aegis supported the Nextcloud backup target! I was hacking my way around on earlier versions of Android using Solid Explorer's connection to my Nextcloud, but that stopped working somewhere along the way. Reconnected via the Storage Access Framework and backups are syncing! Thank you, alexbakker
- rounakdatta 4y agoThanks for supporting the Nextcloud backup - win win! App is perfect, just a single feedback: Possibly find a way to auto-populate the logo images of the apps?
- GordonS 4y agoI switched to Aegis recently, and I did it for only 2 reasons: 1) I prefer to use OSS when possible 2) Aegis supports import/export/backup - so if I get a new phone, I don't have to spend days setting up my dozens of accounts again! This also means I can setup the same OTPs in both Keepass and my phone, so I can always get into my accounts I'm really liking it, it does the same job as the Google and Microsoft Authenticator apps, but import/export/backup means it's more usable
- Rygian 4y agoI can import/export with Google authenticator (via QR codes).
- GordonS 4y agoIIRC, it didn't used to give you any control over import/export, and only supported using an opaque Google storage option. Has that changed? Aegis gives me the actual seed, full control of the data so I can do with it as I please.
- cbsmith 4y agoTends not to work to well in the scenario where you drop your phone into the ocean.
- openplatypus 4y agoKeep away from oceans.
- cbsmith 4y agoSounds like a good plan.
- Rygian 4y agoNormally one does their backups before they are necessary.
- 4y ago
- branon 4y agoRecently had a hard time exporting 20+ OTP secrets from Google Authenticator. I believe I discovered a bug in the app: if you long press a secret > edit > leave an empty string as the comment, and then export a QR code containing this secret, your other device will fail to import ("QR code cannot be interpreted."). I've only seen this happen with secrets where the comment is put in parentheses and appended to the regular, immutable name of the secret. There's another type of secret where the entire name can be edited, this I did not test. But if you try the import/export flow on a secret whose name contains `()` I bet you'll hit the bug. I briefly tried Aegis but you must have Aegis+Authenticatior installed, and be root, or you can exfiltrate Authenticator's database file from private storage, which best as I can tell, also requires root. Shouldn't have gone with Authenticator at all, I've learned. It seems optimal to simply retain the original secret (QR code or whichever medium) you are given when 2FA is initially enabled. Later found this equivalent: https://mattscodecave.com/posts/how-to-move-from-google-authenticator-to-aegis.html https://mattscodecave.com/posts/how-to-move-from-google-auth...
- alexbakker 4y agoThere's a third option to switch from Google Authenticator to Aegis. You can simply scan those export QR codes of Google Authenticator with Aegis.
- chinathrow 4y agoWouldn't that need a second device since one can't screenshot Google Authenticator?
- alexbakker 4y agoCorrect.
- password4321 4y agoOr take a picture of the phone screen, say with a webcam.
- branon 4y ago
- waynesonfire 4y agoI prefer the insecure ones. /s
- voidee 4y agoFYI: For iOS users looking for alternatives to Google Authenticator or Authy, I highly recommend the open source Raivo. https://raivo-otp.com/ https://raivo-otp.com/ Recently moved all of my TOTPs to it. Encrypted iCloud sync and local backup if desired.
- bede 4y agoThanks for this, I'm currently using both Duo to Microsoft authenticator, and the lack of firm reassurance about the backup mechanisms in each of these makes me uneasy. I'd frankly prefer a vault with a model similar to BitWarden's, where I can export my private keys.
- ajyey 4y agoLove raivo. Wish there was an automated backup solution though
- yewenjie 4y agoI was happily using andOTP but seems like it has been unmaintained since June - https://github.com/andOTP/andOTP https://github.com/andOTP/andOTP. I wish F-Droid or Play Store had a feature like GitHub's 'Archived' to inform users.
- kevinfiol 4y agoI'm still using andOTP and I prefer it over Aegis. Are there any reasons to stop using it if it still works? What kind of security vulnerability can affect it? Honest questions.
- yellowapple 4y agoI'm wondering the same thing. It also looks like while Aegis is actively developed on GitHub, that hasn't materialized into a new release on the Play Store or F-Droid in 7 months.
- alexbakker 4y agoYou're right, it's been a while, but we actually issued a beta release for 2.1 today!
- yellowapple 4y agoNice. Will that hit F-Droid at some point? Or do we gotta wait for the non-beta release?
- 22c 4y agoAlso a happy andOTP user. Initially I thought you were being impatient because no updates for a few months isn't necessarily bad, but I see that the project itself has been updated to reflect that it is not being maintained by its creator. Thanks for the heads up. Looking at Aegis, it appears to support importing from andOTP
- petre 4y agoIt's the only decent authenticator that I've found on the play store.
- RealStickman_ 4y agoHow does this compare to FreeOTP+ ?
- nanomonkey 4y agoYou can securely store and generate TOTP tokens in emacs: https://www.masteringemacs.org/article/securely-generating-totp-tokens-emacs https://www.masteringemacs.org/article/securely-generating-t... Since I have emacs on everything, including my phone, it's not a bad solution for my purposes.
- pkulak 4y agoOf course you can.
- Krisjohn 4y agoThe authenticator you use is less important than the process you use to store the TOTP QR codes/secret keys. Never just feed it into an app, always screenshot it and store it somewhere safe THEN put it in something that can generate your TOTP codes.
- wanderingmind 4y agoAegis is an excellent FOSS Authenticator that is available in FDroid. However, offline first apps are challenging to use TOTP across multiple devices. These days I just use TOTP provided by my password manager (Bitwarden) that is seamless across devices.
- gigatexal 4y ago“Secure 2FA” app is an odd title. A 2FA app is nothing if it’s not secure. The “secure” bit here is redundant. The fact that it has to be said is actually a red flag. Are you saying it’s secure because in reality it really isn’t?
- kornhole 4y agoThis is a great switch from AOTP that I just did. The more exciting thing I learned here is that I can backup my entire GrapheneOS phone to my Nextcloud server for recovery. I just go into Android settings->Backup to get started. This will save me a lot of time the next time I lose my phone. Thank you!
- 725686 4y agoWho makes this? How do I know it is trustworthy? I know its supposed to be open source, but when you install from the app store you don't really know what you are installing. I trust Twilio's Authy a tad more than a random app with a nice home page.
- jayknight 4y agoIt is also available on f-droid, and they compile the apps themselves instead of distributing compiled apps. So if you trust f-droid, you know it is the same as the open source code.
- neilv 4y agoYou need parties you trust auditing all the code and each change, before you run it.
- commoner 4y agoF-Droid does check code before privacy violations for accepting it. Any potential privacy violations are labeled as "anti-features" and apps that don't meet F-Droid's inclusion criteria are rejected: https://f-droid.org/docs/Inclusion_Policy/ https://f-droid.org/docs/Inclusion_Policy/ Aegis Authenticator passed F-Droid's checks. It has no anti-features: https://f-droid.org/en/packages/com.beemdevelopment.aegis/ https://f-droid.org/en/packages/com.beemdevelopment.aegis/ Aegis doesn't even request the internet permission. Compare that with Authy, which logs users' IP addresses, login activity, phone numbers, and email addresses, and states that users' data and personal information will be shared with third parties for any reason Authy wants to: https://www.twilio.com/legal/privacy/authy https://www.twilio.com/legal/privacy/authy Twilio has had 2 data breaches this year, and the second one involved Authy. Since Authy does not use end-to-end encryption, hackers were able to obtain 2FA credentials from any Authy account, and they compromised the accounts of 93 Authy users: https://techcrunch.com/2022/08/26/twilio-breach-authy/ https://techcrunch.com/2022/08/26/twilio-breach-authy/ On top of that, Authy is closed source and its code has never been audited, not even by F-Droid. There is no way to use Authy without sending your personal information to a service that states it will not promise to keep it private. There is no good reason to trust Authy over Aegis.
- Vixel 4y agoI've always been aware of Aegis, but is there any reason to use this over the built in TOTP tool in a password manager like Bitwarden?
- lazyeye 4y agoFor redundancy I bought a cheap android camera phone with no sim card as a backup. I always register my authenticator codes on multiple phones at the same time.
- ur-whale 4y agohttps://github.com/pcarrier/gauth https://github.com/pcarrier/gauth
- sedatk 4y agoI hope that Passkeys would make TOTP obsolete soon. It's done its job during the era of reused passwords, but now it's unwieldy and unnecessarily prone to phishing.
- BatteryMountain 4y agoI've been using FreeOTP+ for a while now, since it makes it easy to backup my tokens and has biometrics. I've given Aegis a spin, I think I will keep using it, for grouping/sorting alone. I have a ton of old keys that clutter things up.
- lrvick 4y agoWhy is anyone even modestly technical still using a phone for 2FA? I do not understand. Yubikeys, Ledgers, Trezors, Nitrokeys, Mooltipass, Precursor, QubesOS Vault... There are so many solutions that avoid exposing your 2FA secrets in plaintext to the system memory of an internet connected device.
- nokya 4y agoGlad to see this tool getting more traction: - biometric/passcode authentication - grouping - backup/restore function that works - no data leakage/no ads. I recommend it everytime I see someone popping out a Google authenticator or alike. The only thing Aegis lacks is a donate button or a paid version just for supporting its development. I'm anticipating this tool will soon be ripped apart with ads, data leakage, an acquisition, or a premium version that will just break what it does very well until now. I'm enjoying it while it lasts :)