6 ms·

The killer feature for me is a way to quickly access tokens in my (cloud-side, encrypted) vault from a desktop (or web) app in case of emergency. It's not clea

The killer feature for me is a way to quickly access tokens in my (cloud-side, encrypted) vault from a desktop (or web) app in case of emergency. It's not clear to me if Aegis allows this somehow? The other day I broke my phone. I was traveling and needed to do some 2FA level changes to a GH repo asap. I didn't even know there was an Authy desktop app until then. It saved my ass, literally.

alexbakker 4y ago
Aegis is fully offline and doesn't have an official desktop application. You could of course create an export of your Aegis vault and import it in a third-party desktop application, like GNOME's Authenticator or OTPClient.
- tlaundal 4y ago
  This is what I do. Two "live" authenticators with my phone and laptop and a secure offsite backup. I don't add new keys particularily often, so it isn't that big of a hassle two manually sync the authenticators.
  - remram 4y ago
    What app do you use on the laptop?
nashashmi 4y ago
Try http://totp.app http://totp.app
pluc 4y ago
Yubikeys store everything on the key. I can lose my phone and use your phone to see my 2FA codes. It's honestly one of the only way MFA make sense - otherwise you lock yourself out of your entire digital life when you lose your phone and need to rely on storing your backup codes (which opens up a storage security wormhole). It's also a lot easier to wear around your neck.
- SoftTalker 4y ago
  So you've moved the worry from losing/breaking your phone to losing/breaking your YubiKey?
  - pluc 4y ago
    Sure. I have a backup key but yes, you can't get MFA without adding a device that you may lose; whether that's your phone or a key. Like I said I prefer a key because I can't put my phone on a chain around my neck or on my keychain.
  - hospadar 4y ago
    I keep a second key as backup for this reason, which honestly is overkill and I only do because I got a second one for free at a conference. Easier solution (which I also use in case I someday need the second one only to discover that the blue smoke leaked out) is to just print out the TOTP secrets and keep them somewhere. I'm usually printing out recovery codes when I get a new TOTP secret so this has never felt like a big deal. Also easy enough to maintain a keepass[xc] vault for totp secrets, you could keep a separate one from your passwords if you were feeling paranoid. Great support on mobile and desktop for using a keepass db as a TOTP source - and easy to sync with dropbox/email/ssh/your web server/whatever
    - jve 4y ago
      Everyone should read this risk mitigation solution for loosing 2FA. I always think about printing recovery codes, but having keepass vault with those codes also sounds great. You may even have some random password there and store it printed out in some locations just for emergency. Anyways, people should think about these risks when dealing with 2FA: flood, fire, stolen, lost, (I) broke (Smartphone, yubikey, usb, etc), broke (itself), software bug, kids, washing machines, etc.
      - ngrilly 4y ago
        And also something we usually don’t consider: loss of memory, which can occur in combination with a traumatic event like your house burning. Then you can loose your smartphone, your Yubikey, your printed copy, and your memory all at the same time if everything is stored in one place. And this is exactly when you will need those the most. Not easy to defend against such a nightmarish scenario.
rsync 4y ago
"I didn't even know there was an Authy desktop app until then. It saved my ass, literally." That's a really unexpected outcome - can you provide any details ?
- virtualritz 4y ago
  > [...] can you provide any details ? I installed Authy desktop, logged in and it retrieved my tokens form the cloud. Not anything else to it.
  - BenjiWiebe 4y ago
    Pretty sure they're referring to the word 'literally'. Especially since it's by itself after a comma, looks like there's emphasis on it. That word changes the meaning of the phrase in front of it quite a bit.
    - rsync 4y ago
      I am literally never going to stop misusing this word.
- remram 4y ago
  https://authy.com/download/ https://authy.com/download/
deleted 4y ago
[deleted]
PufPufPuf 4y ago
You can export the vault (encrypted or not) to a cloud provider (like Google Drive). It's a manual process, but it's simple and quick. Besides, how often do you add new 2FA tokens anyway?
s_ting765 4y ago
The answer you're looking for is Aegis vault backup + Syncthing or Nextcloud. Seriously. I once lost my Authy app data and didn't have it installed on any other of my devices (silly requirement tbh). I don't know whether cloud or 2FA is the joke here but Authy slapped me with a 24hr wait time for a "device reset".
traceroute66 4y ago
Don't know if it exists for Android, but for iPhone users there is OTP Auth, which can make encrypted backups to a destination of your choice.
arcanemachiner 4y ago
You can export it to file whenever you add a new key. Then, use SyncThing to sync the copy to a remote location. The exported file can be encrypted when you make it.
- virtualritz 4y ago
  Yeah, that's a UX problem. I need to do that every time and remember. From my experience, you loose access when the last backup you made and synced was made before the key you need now was added. I.e. this doesn't work in practice.
  - jorams 4y ago
    If you enable automatic backups in the Aegis settings it will create a backup after every change. If you set the output directory to a location synced by Syncthing, there's nothing to remember.
commoner 4y ago
Aegis has two automatic encrypted backup options. The first lets you back up your data to any folder on your device or to any storage provider (e.g. Nextcloud and other cloud storage providers) linked to your device. Turn this on at Settings > Backups > Automatically back up the vault. The storage provider's app needs to be installed. Changes are saved to the backup location automatically. The second uses the OS's built-in backup feature. For Android devices with Google Play Services, the backup is saved on Google Drive. Some other Android distributions such as LineageOS use Seedvault, which can save the backup to any WebDAV provider or an external USB drive. This option is at Settings > Backups > Participate in Android's backup system. Either or both options can be used in Aegis.
hnews_account_1 4y ago
I can’t believe this is a tech forum. The answer is simple. 2FA has a url. All you have to do is store the url in your password manager. Then you can import it into any new app at a moment’s notice (as long as you have access to the vault) and generate a 2fa code. In fact, KeePassium on iOS works on this concept. I use it as my primary otp url storage app and then put limited stuff into aegis on my android tablet for anything I may need there. If a keepass based app with an otp generator (like KeePassium) existed for android, I wouldn’t even need that.
aceazzameen 4y ago
Bitwarden can store and then copy/paste TOTPs. I'm not sure if it's the best security practice to have your password and TOTP key saved together like that. But I tend to use it for sites that I don't consider critical. I then use Google Authenticator for everything else. I might try Aegis next time I get a new phone though.
Helmut10001 4y ago
AEGIS has this killer feature, with the encrypted database, which I could sync to my local Nextcloud instance. Otherwise, loosing the phone would always mean loosing all your OTPs. Aegis is a direct (better) replacement for Google Authenticator.
shaicoleman 4y ago
There's a python script to decrypt the vault which you can use from a desktop with a little bit of code. https://github.com/beemdevelopment/Aegis/blob/master/docs/decrypt.py https://github.com/beemdevelopment/Aegis/blob/master/docs/de...

alexbakker 4y ago

Aegis is fully offline and doesn't have an official desktop application. You could of course create an export of your Aegis vault and import it in a third-party desktop application, like GNOME's Authenticator or OTPClient.

tlaundal 4y ago
This is what I do. Two "live" authenticators with my phone and laptop and a secure offsite backup. I don't add new keys particularily often, so it isn't that big of a hassle two manually sync the authenticators.
- remram 4y ago
  What app do you use on the laptop?

nashashmi 4y ago

Try http://totp.app http://totp.app

pluc 4y ago

Yubikeys store everything on the key. I can lose my phone and use your phone to see my 2FA codes. It's honestly one of the only way MFA make sense - otherwise you lock yourself out of your entire digital life when you lose your phone and need to rely on storing your backup codes (which opens up a storage security wormhole). It's also a lot easier to wear around your neck.

SoftTalker 4y ago
So you've moved the worry from losing/breaking your phone to losing/breaking your YubiKey?
- pluc 4y ago
  Sure. I have a backup key but yes, you can't get MFA without adding a device that you may lose; whether that's your phone or a key. Like I said I prefer a key because I can't put my phone on a chain around my neck or on my keychain.
- hospadar 4y ago
  I keep a second key as backup for this reason, which honestly is overkill and I only do because I got a second one for free at a conference. Easier solution (which I also use in case I someday need the second one only to discover that the blue smoke leaked out) is to just print out the TOTP secrets and keep them somewhere. I'm usually printing out recovery codes when I get a new TOTP secret so this has never felt like a big deal. Also easy enough to maintain a keepass[xc] vault for totp secrets, you could keep a separate one from your passwords if you were feeling paranoid. Great support on mobile and desktop for using a keepass db as a TOTP source - and easy to sync with dropbox/email/ssh/your web server/whatever
  - jve 4y ago
    Everyone should read this risk mitigation solution for loosing 2FA. I always think about printing recovery codes, but having keepass vault with those codes also sounds great. You may even have some random password there and store it printed out in some locations just for emergency. Anyways, people should think about these risks when dealing with 2FA: flood, fire, stolen, lost, (I) broke (Smartphone, yubikey, usb, etc), broke (itself), software bug, kids, washing machines, etc.
    - ngrilly 4y ago
      And also something we usually don’t consider: loss of memory, which can occur in combination with a traumatic event like your house burning. Then you can loose your smartphone, your Yubikey, your printed copy, and your memory all at the same time if everything is stored in one place. And this is exactly when you will need those the most. Not easy to defend against such a nightmarish scenario.

rsync 4y ago

"I didn't even know there was an Authy desktop app until then. It saved my ass, literally." That's a really unexpected outcome - can you provide any details ?

virtualritz 4y ago
> [...] can you provide any details ? I installed Authy desktop, logged in and it retrieved my tokens form the cloud. Not anything else to it.
- BenjiWiebe 4y ago
  Pretty sure they're referring to the word 'literally'. Especially since it's by itself after a comma, looks like there's emphasis on it. That word changes the meaning of the phrase in front of it quite a bit.
  - rsync 4y ago
    I am literally never going to stop misusing this word.
remram 4y ago
https://authy.com/download/ https://authy.com/download/

deleted 4y ago

[deleted]

PufPufPuf 4y ago

You can export the vault (encrypted or not) to a cloud provider (like Google Drive). It's a manual process, but it's simple and quick. Besides, how often do you add new 2FA tokens anyway?

s_ting765 4y ago

The answer you're looking for is Aegis vault backup + Syncthing or Nextcloud. Seriously. I once lost my Authy app data and didn't have it installed on any other of my devices (silly requirement tbh). I don't know whether cloud or 2FA is the joke here but Authy slapped me with a 24hr wait time for a "device reset".

traceroute66 4y ago

Don't know if it exists for Android, but for iPhone users there is OTP Auth, which can make encrypted backups to a destination of your choice.

arcanemachiner 4y ago

You can export it to file whenever you add a new key. Then, use SyncThing to sync the copy to a remote location. The exported file can be encrypted when you make it.

virtualritz 4y ago
Yeah, that's a UX problem. I need to do that every time and remember. From my experience, you loose access when the last backup you made and synced was made before the key you need now was added. I.e. this doesn't work in practice.
- jorams 4y ago
  If you enable automatic backups in the Aegis settings it will create a backup after every change. If you set the output directory to a location synced by Syncthing, there's nothing to remember.

commoner 4y ago

Aegis has two automatic encrypted backup options. The first lets you back up your data to any folder on your device or to any storage provider (e.g. Nextcloud and other cloud storage providers) linked to your device. Turn this on at Settings > Backups > Automatically back up the vault. The storage provider's app needs to be installed. Changes are saved to the backup location automatically. The second uses the OS's built-in backup feature. For Android devices with Google Play Services, the backup is saved on Google Drive. Some other Android distributions such as LineageOS use Seedvault, which can save the backup to any WebDAV provider or an external USB drive. This option is at Settings > Backups > Participate in Android's backup system. Either or both options can be used in Aegis.

hnews_account_1 4y ago

I can’t believe this is a tech forum. The answer is simple. 2FA has a url. All you have to do is store the url in your password manager. Then you can import it into any new app at a moment’s notice (as long as you have access to the vault) and generate a 2fa code. In fact, KeePassium on iOS works on this concept. I use it as my primary otp url storage app and then put limited stuff into aegis on my android tablet for anything I may need there. If a keepass based app with an otp generator (like KeePassium) existed for android, I wouldn’t even need that.

aceazzameen 4y ago

Bitwarden can store and then copy/paste TOTPs. I'm not sure if it's the best security practice to have your password and TOTP key saved together like that. But I tend to use it for sites that I don't consider critical. I then use Google Authenticator for everything else. I might try Aegis next time I get a new phone though.

Helmut10001 4y ago

AEGIS has this killer feature, with the encrypted database, which I could sync to my local Nextcloud instance. Otherwise, loosing the phone would always mean loosing all your OTPs. Aegis is a direct (better) replacement for Google Authenticator.

shaicoleman 4y ago

There's a python script to decrypt the vault which you can use from a desktop with a little bit of code. https://github.com/beemdevelopment/Aegis/blob/master/docs/decrypt.py https://github.com/beemdevelopment/Aegis/blob/master/docs/de...