4 ms·

Yeah, super-ugh. Every 2FA vendor wants to lock you in. I was able to export secrets from GAuthenticator on a rooted phone with sqlite, it looks like that is

Yeah, super-ugh. Every 2FA vendor wants to lock you in. I was able to export secrets from GAuthenticator on a rooted phone with sqlite, it looks like that is still possible on Authy too. Another vote for rooting your phone.

graphe 3y ago
I wish I knew this. I have a version of gauth that wasn't able to be exported on an old phone. I lost a bunch of crypto because of this.
jasonjayr 3y ago
I REALLY want to like passkeys, and all these other stronger vendor systems, but the lock in is real. Office365 defaults to their special authenticator, and you have to jump through hoops on the admin side to ensure TOTP is an option. It will be a very real improvement to security for non-tech users, but the refusal to let folks be 100% in control of their key material, and the lazy "it will be available in a later version, we're focusing on the most common use cases" just tells me that the implementers really don't want to do it in the first place: they're waiting for lockin with what's available, and then they'll just say "Well people adopted it w/o this feature, they must not really want it" There 100% has to be a way for the user to own + backup their own private key material, or these are all just paths for stronger lockin. Personally, I have a TOTP App (andOTP) with QRCodes on paper in cold storage, keepass-based tools for passwords across platforms, and Syncthing for syncing across these systems.
- lxgr 3y ago
  Unfortunately there is no key exchange format specified in either FIDO or WebAuthN, which I view as a major downside as well. The closest you can currently get is an open-source authenticator implementation that lets you export its credentials, like e.g. Bitwarden does (it supposedly lets you export WebAuthN credentials via JSON, but I haven't tried it myself). I get that any UI way to let users export credentials is a potential phishing/social engineering avenue, but the lock-in danger is real, and I'm holding back on WebAuthN as my primary authentication method for now.
lxgr 3y ago
The newest version of Google Authenticator just lets you display the setup QR code again, no rooting necessary!
noman-land 3y ago
Aegis is great.

graphe 3y ago

I wish I knew this. I have a version of gauth that wasn't able to be exported on an old phone. I lost a bunch of crypto because of this.

jasonjayr 3y ago

I REALLY want to like passkeys, and all these other stronger vendor systems, but the lock in is real. Office365 defaults to their special authenticator, and you have to jump through hoops on the admin side to ensure TOTP is an option. It will be a very real improvement to security for non-tech users, but the refusal to let folks be 100% in control of their key material, and the lazy "it will be available in a later version, we're focusing on the most common use cases" just tells me that the implementers really don't want to do it in the first place: they're waiting for lockin with what's available, and then they'll just say "Well people adopted it w/o this feature, they must not really want it" There 100% has to be a way for the user to own + backup their own private key material, or these are all just paths for stronger lockin. Personally, I have a TOTP App (andOTP) with QRCodes on paper in cold storage, keepass-based tools for passwords across platforms, and Syncthing for syncing across these systems.

lxgr 3y ago
Unfortunately there is no key exchange format specified in either FIDO or WebAuthN, which I view as a major downside as well. The closest you can currently get is an open-source authenticator implementation that lets you export its credentials, like e.g. Bitwarden does (it supposedly lets you export WebAuthN credentials via JSON, but I haven't tried it myself). I get that any UI way to let users export credentials is a potential phishing/social engineering avenue, but the lock-in danger is real, and I'm holding back on WebAuthN as my primary authentication method for now.

lxgr 3y ago

The newest version of Google Authenticator just lets you display the setup QR code again, no rooting necessary!

noman-land 3y ago

Aegis is great.