[HN Gopher] Aegis Authenticator - open-source 2FA for Android
___________________________________________________________________
Aegis Authenticator - open-source 2FA for Android
Author : ignitionmonkey
Score : 66 points
Date : 2021-01-16 18:08 UTC (4 hours ago)
(HTM) web link (getaegis.app)
(TXT) w3m dump (getaegis.app)
| teamspirit wrote:
| My big thing with these apps, Authy, Duo, Google Authenticator is
| site icons. Authy finally figured out a way to query the website
| and either get the favicon or some image from the website. I
| know, it's really the most minuscule part but it frustrates me to
| see "(D)" for Digital Ocean. But it's enough to keep me with it.
| ignitionmonkey wrote:
| Icon packs are coming [1] and you can set your own for the more
| niche sites.
|
| The problem with querying websites for their icon is that it
| leaks data about you (your phone and desktop) to a third-party
| without a proxy, requires a domain to match against, and like
| with Authy, the icons go out of date and become inconsistent.
| Worst of all, you have to give network access to the entire app
| for a trivial feature, making it less secure and trustworthy.
| Offline icon packs that have a consistent look is a good
| solution to all of this. [2]
|
| [1] https://github.com/beemdevelopment/Aegis/issues/509
|
| [2] https://github.com/aegis-icons/aegis-icons
| enshake wrote:
| Authy now adds the site logo automatically. If not, you can
| search one up in the app
| Ayesh wrote:
| Sucks that there is no Windows version. Android one looks pretty
| nice and I like that there are many import/export options
| loloquwowndueo wrote:
| Lol windows :) no seriously if you need an OATH application for
| windows you can probably coerce oathtool to run under WSL or
| even natively.
| Zizizizz wrote:
| you can install this > export backup to JSON > import to pass-
| otp and you have 2fa in your command line and phone
| based2 wrote:
| https://github.com/beemdevelopment/Aegis GPLv3
| ryukafalz wrote:
| Nice, I consider that a good sign! Means it's unlikely to ever
| go proprietary like Google Authenticator did.
| supernova87a wrote:
| I don't know about you but does anyone else screenshot (and even
| print physical copies of, to keep safe) their authenticator
| barcodes given by websites, in case some day your chosen app dies
| or your phone(s)/tablets/everything gets lost?
| jamiesonbecker wrote:
| You can use the QR codes to enroll new devices. (But then so
| can anyone who finds your QRs, so if you do this, keep them
| safe)
| Hamuko wrote:
| That's really what scratch codes are for.
| [deleted]
| cuu508 wrote:
| Yes, but not every service offers recovery codes.
| loloquwowndueo wrote:
| That's like a must. Services that don't probably have an
| easy way to reset your 2FA via email verification which
| entirely negates the benefit of 2FA (last line of defence
| if your password or email are compromised). You probably
| want to stay away from those services entirely.
| tarruda wrote:
| Aegis has an option to export an encrypted backup of the
| database. I export one every time I add a new code to the app.
| alexbakker wrote:
| One of the authors here. Recent versions of Aegis also come
| with an automatic backup feature, so that an export is
| created at a location of your choosing automatically every
| time a change is made to your entry list. Might be a little
| more convenient than doing manual exports every time.
| [deleted]
| imiric wrote:
| I use Aegis, but also import the TOTP URI to pass, and use it
| with pass-otp[1].
|
| It kind of defeats the purpose of 2FA, but I keep my pass repo
| relatively secure, and the convenience is worth it.
|
| [1]: https://github.com/tadfisher/pass-otp
| Iolaum wrote:
| Yes I do keep backups.
| ffpip wrote:
| I sometimes do that when I don't have to write them down.
| Youden wrote:
| I put them into Bitwarden alongside the password.
|
| Yes, that means that there's a single place where both factors
| are stored but if Bitwarden has two-factor authentication (it
| does), the two factors are preserved.
| petespeed wrote:
| Anyone knows if and how to use this instead of Microsoft
| authenticator?
| ffpip wrote:
| I think Microsoft Authenticator is internet based. The 2FA
| secret key is backed up to their servers.
|
| Aegis is open source, free and has backup and restore
| functionality. It also has a great UI and custom icon support.
|
| Under active development -
| http://github.com/beemdevelopment/aegis
| ktzar wrote:
| I use andOTP, open source and can export and import keys so you
| can have them backed up.
| ignitionmonkey wrote:
| They're pretty similar apps in terms of features (Aegis does
| all of that too).
|
| Personally, comparing screenshots, I think Aegis' interface and
| choice of colours is more sleek, especially in dark and OLED
| modes, so it got my pick.
| lucideer wrote:
| andOTP used to have some pretty bad issues with security. I
| switched from andOTP over to Aegis way back then; I've heard
| that the andOTP author has been extremely active & responsive
| since, and responded/fixed the aforementioned issues over time,
| but I've been so happy with Aegis that I haven't felt compelled
| to go back.
| PradeetPatel wrote:
| From a user's perspective, what does it have over other 2FA apps
| such as Google Authenticator or Duo?
| livre wrote:
| I use this after having used Google Authenticator, what made me
| switch is easy backups and restores, not to the cloud but
| locally to a file. Also you don't need a Google Account if you
| wish to transfer your data to a new device.
| ignitionmonkey wrote:
| To add to this. Aegis supports any cloud provider that
| implements Android's "Storage Access Framework".[1]
|
| https://github.com/beemdevelopment/Aegis/issues/258#issuecom.
| ..
| gmac wrote:
| I can't tell from the homepage, but perhaps it supports SHA256?
| Google Authenticator on Android (but not, weirdly, on iOS)
| pretends to be fine with SHA256 but then goes ahead and uses
| SHA1, and thus generates wrong codes.
| livre wrote:
| It supports SHA1, SHA256 and SHA512.
| lucideer wrote:
| Being open-source is not of exclusive benefit to non-users.
|
| Additionally, being non-Google would be considered a large
| benefit by many non-technical users I know.
| ffpip wrote:
| Better UI and custom icon support for the random website you
| have.
|
| Plus this is offline. Hence more secure.
| vvatermelone wrote:
| You can require biometric authentication to view the codes,
| that's the main reason I use it over GA.
| gchamonlive wrote:
| Currently using Authy. Any way to migrate my keys in bulk?
| [deleted]
| ignitionmonkey wrote:
| If you have root access, yes.[1] Otherwise no, sadly. One of
| the reasons I moved off Authy before it got worse.
|
| There is a workaround using the Authy Desktop app but I have no
| idea if it works.[2]
|
| [1] https://github.com/beemdevelopment/Aegis/pull/107
|
| [2]
| https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d...
| gchamonlive wrote:
| commented on my question with a snipped I wrote based on that
| extraction method from authy. The code generates a Aegis
| compatible database instead of printing QR codes
| gchamonlive wrote:
| Done, migrated 40 accounts to Aegis.
|
| As I see, it backs up to the internal storage, so I have to
| use another app to sync the backup to a cloud of my choice
| ignitionmonkey wrote:
| Might have a solution for you here:
|
| https://news.ycombinator.com/item?id=25804860
| ffpip wrote:
| > so I have to use another app to sync the backup to a
| cloud of my choice
|
| You can select Google Drive/Dropbox when backing up the
| vault.
|
| https://github.com/beemdevelopment/Aegis/issues/258#issueco
| m...
| gchamonlive wrote:
| doesn't seem to show for me, only internal space. I have
| no idea why.
|
| edit: this is not released yet, I think
| alexbakker wrote:
| One of the authors here.
|
| Unfortunately, Google Drive and Dropbox only partially
| participate in Android's Storage Access Framework. In
| Aegis, exporting only requires the creation of a file, so
| that works with both. Configuring backups on the other
| hand requires selecting a folder, but most cloud
| providers don't support that. A notable exception is
| Nextcloud.
| gchamonlive wrote:
| in response to myself, I created a snippet to generate a
| database in bulk from authy.
|
| follow:
| https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d...
|
| But change the code with:
|
| https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d...
| anthony_barker wrote:
| Been testing this - migrated from FreeOTP (redhad).
|
| I have a conflict on export of keys for backup. But then you kind
| of need it in the event you loose the phone (so you don't have to
| rely on sms or email to recover account access).
|
| Personally I think the best security I have seen is in Keybase or
| Matrix with the trusted devices concept. I like how keybase
| allows for one of the devices to be a paper device.
| exabrial wrote:
| Sounds awesome!
|
| Authy is fricken awful. It requires SMS for "security" entirely
| defeating the purpose of 2FA. Worse off, some SAASs _require_
| Authy specifically.
|
| Think about that. That means the security of an enterprise system
| at your company is completely dependent on whether or not an
| individual secures their personal cell phone account. Absolutely
| stupid, avoid Authy like the plague.
| phreack wrote:
| Anecdotally, I've seen a few places that instead of mentioning
| the protocol just say 'download G Auth' or 'download Authy',
| and so far all of those worked with Aegis when I tried.
| tobib wrote:
| I've been using Authy for a long time and have never come
| across SMS for security. When would that be triggered?
| MayeulC wrote:
| I used to use andOTP, mainly because it was possible to export
| OTP tokens when upgrading or resetting my phone.
|
| Then IIRC I heard that andOTP wasn't that secure/maintained. Or
| maybe that their backup file encryption wasn't that great. I am
| not sure about these claims, but _I migrated to Aegis_ , that
| could nicely import AndOTP tokens.
|
| Nowadays, I use it in combination with bitwarden (it supports
| OTP), which I use for my less important accounts. Bitwarden
| (self-hosted with bitwarden-rs) allows me to generate those
| without my phone. I still keep every token in Aegis as well.
|
| AndOTP features I miss with Aegis:
|
| - Icon library for common websites using OTP
|
| - Maybe Steam OTP support? I never used it though, since it would
| more or less lock me out of trading, without the app, so I use
| e-mail.
| [deleted]
| alexbakker wrote:
| One of the authors here.
|
| > Icon library for common websites using OTP
|
| Someone from the community is maintaining an icon pack for
| Aegis: https://github.com/aegis-icons/aegis-icons. We're
| currently working on making icon packs easier to use in Aegis,
| see: https://github.com/beemdevelopment/Aegis/issues/509.
|
| > Maybe Steam OTP support
|
| Steam is supported, actually! But like you said, you'd still
| need the Steam app if you're doing trading.
| MayeulC wrote:
| Hey there, thanks for Aegis, it is my main OTP vault for
| important suff.
|
| Thank you and your sibling comment. I'm glad this is being
| worked on! Discovery is also important IMO, so a one-tap
| install of the most widely used icon pack would be nice to
| have too :)
| alexbakker wrote:
| Thanks for your support! That's a fair point. We'll see
| what the feedback is like when we release initial support
| for icons packs and decide whether to include a pack out of
| the box after that.
| ignitionmonkey wrote:
| Icon packs are coming. [1] Steam accounts can be imported if
| you have root access, or you can try [2].
|
| IIRC Steam codes are almost standard except they use a
| different encoding because... Valve likes to roll their own
| stuff (?). I agree that trading makes only having codes a bit
| less useful. They could've used the same codes to confirm
| trades instead of an entirely separate interface.
|
| [1] https://github.com/beemdevelopment/Aegis/issues/509
|
| [2] https://github.com/beemdevelopment/Aegis/wiki/Adding-
| Steam-t...
| MayeulC wrote:
| Thanks for pointing this out.
|
| Yeah, steam rolling their own stuff is a bit troublesome at
| ties, but I think they were among the first to use TOTP
| tokens, IIRC ? There was a story here the other day on how
| they roll their own password encryption over HTTPS for
| logging in... It's a shame they don't use standard
| authentication mechanisms, though.
|
| And I should clarify: my yubikey is my main 2FA token, though
| support for U2F/Webauthn is a bit limited.
| ffpip wrote:
| Can you add 'app' to the title?
|
| Open source 2FA App for Android.
___________________________________________________________________
(page generated 2021-01-16 23:01 UTC)