3 ms·
That's a potentially terrifying breach because your second factor has effectively been permanently backdoored by the app developer without your knowledge. I'm h
by seanhunter 4y ago
That's a potentially terrifying breach because your second factor has effectively been permanently backdoored by the app developer without your knowledge. I'm hoping this has been reported and a check for this sort of thing is added to the review process for all MFA apps.
On a related note: security experts of HN which (if any) TOTP authenticator apps would you use/recommend? I currently use duo authenticator except for one thing which bafflingly will only work with google authenticator and not duo (don't ask me why) or things like steam or lastpass which have their own homebaked authentication app. Any reason to use something different?
- seanhunter 4y agoI should add I have no particular affiliation with duo. I ended up with it because I worked at a place that did the duo push authentication thing as the MFA enterprise SSO. Having installed the app, every time I needed an authenticator it's just what I had and therefore used.
- brylie 4y agoI'm not a security expert, so consider this an anecdote, but I use Bitwarden to store my passwords and TOTP tokens.
- msravi 4y agoI used Authy initially. I then exported all the TOTP tokens out of Authy and imported them into unix pass and Aegis. So on my laptop I just use pass, and on mobile it's Aegis.
- seanhunter 4y agoI use pass myself. I had no idea you could use it for otp. Are you using something like this? https://github.com/tadfisher/pass-otp https://github.com/tadfisher/pass-otp
- msravi 4y agoYes! That's what I use - it's very convenient. The first line of the pass file needs to be the totp string, that's all. But you can also use oathtool at the command line with the secret. oathtool -b --totp <otp secret>
- vegardx 4y agoIt doesn't have to be the first line of a password store file, it can be anywhere in the file, as long as it starts with `otpauth://`. You can also just append it using `pass otp append foobar`. There's also a handy app that can read the password store database for both Android and iOS, which also supports OTP.
- msravi 4y agoOh, didn't know that. Thanks! Which is the app?
- vegardx 4y agoI've only used the iOS app, but there's a list of applications and integrations on the website: https://www.passwordstore.org https://www.passwordstore.org The app is also handy for bootstrapping OTP, because some implementations only give you the QR-code, not the secret or URI, and then you have to do the dance with decoding the QR-code before adding it.
- LanternLight83 4y agoOn Android I've being using FDroid hosted apps like KeepassXC, and for OTP have migrated from andOTP to Aegis within the past ~1 year or so.
- phneutral26 4y agoHey, I use the Yubico Authenticator. It (AFAIK) only lets me see the codes if I have my physical yubikey plugged in/connected via NFC. It's basically YubiKey support for Applications/Sites that don't support Hardware Authentication. There is also a Desktop app for Linux, for Windows I am not sure.
- seanhunter 4y agoThat's interesting. THanks. I have a yubikey so that is for sure an option.