Authenticator apps on selfhosted VM reddit / selfhosted ---------------------------------------------------------------------- SysAdmin31 · 2023-10-28 10:02 Yesterday, I accidentally removed an authenticator app from my phone. Fortunately, I have another copy of the app on a different device. It made me realize how easy it is to lock myself out of my accounts. Do you think it's a good idea to create a Windows VM with an Android emulator on it and install copies of all my authenticator apps, this will not cause any security issues? ---------------------------------------------------------------------- zandadoum · 2023-10-28 10:12 why not consolidate your auth apps? i use selfhosted vaultwarden (with backups ofc) for everything, except for vaultwarden, which is protected by authy . and authy can be backed up easily ---------------------------------------------------------------------- Charming_Sheepherder · 2023-10-28 10:28 Back up your seeds at least ---------------------------------------------------------------------- SysAdmin31 · 2023-10-28 10:30 Seeds ? ---------------------------------------------------------------------- usrdef · 2023-10-28 10:30 You should be backing up your secrets to some type of app like Vaultwarden or KeePassXC. And you shouldn't need to VM host an android OS just to have a secondary means of authenticating. There are plenty of apps out there that support adding your secrets. Vaultwarden, KeePassXC, or hell, a Yubikey 5 device and then use Yubikey Authenticator. ---------------------------------------------------------------------- SysAdmin31 · 2023-10-28 10:31 I backup the data but not the apps ---------------------------------------------------------------------- TBT_TBT · 2023-10-28 10:47 That is the reason why I don’t self host my password manager: my 2FA passwords are in there, very conveniently and independently of any other device. ---------------------------------------------------------------------- -quakeguy- · 2023-10-28 10:51 Sane MFA apps explicitly disallow their data from being backed up. That would be a massive attack vector if it was possible. ---------------------------------------------------------------------- shadoodled · 2023-10-28 11:12 Instead of an android emulator, you could self-host a 2FA web app like https://github.com/Bubka/2FAuth ---------------------------------------------------------------------- mpember · 2023-10-28 13:06 >I trust 1Password with that. Oops. https://www.darkreading.com/remote-workforce/1password-latest- victim-okta-customer-service-breach ---------------------------------------------------------------------- TBT_TBT · 2023-10-28 13:16 So? No customer data got leaked. And even if the vaults would get leaked (which they didn’t), they are 2FA encrypted. ---------------------------------------------------------------------- mpember · 2023-10-28 13:22 Did I say customer data got leaked? Did I say the data was unencrypted? The OP asked about having redundant options for 2FA. If a compromise resulted in you no longer having access to your second factor of authentication, that would be an issue. ---------------------------------------------------------------------- TBT_TBT · 2023-10-28 13:35 You basically only said „oops“. Which says nothing. The chances of losing (access to) a phone are way higher than 1Password getting that much compromised that all 2FAs are gone. ---------------------------------------------------------------------- AdventureCoupleCo · 2023-10-28 13:44 2fa is not encryption. ---------------------------------------------------------------------- TBT_TBT · 2023-10-28 14:02 Encrypted and 2FA protected. ---------------------------------------------------------------------- This-Gene1183 · 2023-10-28 14:22 The key you used to create the token with ---------------------------------------------------------------------- vanimox · 2023-10-28 14:39 Screenshot the QR codes and save them all in a folder. If you ever lose your phone it's as simple as rescanning the QR codes to add them back in. That's what I do anyway. ---------------------------------------------------------------------- talent_deprived · 2023-10-28 15:04 I keep my previous Android phone moderately charged and in my desk drawer, ready, should I ever need to use the authenticator app on it if my main phone goes down. ---------------------------------------------------------------------- hexathos · 2023-10-28 15:51 I use the totp in keepassxc for Backup and PC use ---------------------------------------------------------------------- CubeRootofZero · 2023-10-28 15:52 I think that would be the best option for what the OP is looking for. A web accessible version for OTP codes. Problem is then you have to protect that page somehow. That repo shows it can use Yubikeys for AuthN, which IMO is the best way to protect it. I personally put my TOTP seeds in Vaultwarden. Then they sync over to whatever device I'm on. Just protect your Vault login however you need per device. ---------------------------------------------------------------------- PowerfulAttorney3780 · 2023-10-28 17:14 Brilliant ---------------------------------------------------------------------- kon_dev · 2023-10-28 17:36 You could use andOTP. It's possible to create encrypted local backups, just create a new one once you change anything and copy it e.g. to a NAS device. If your phone dies, copy it back and restore. ---------------------------------------------------------------------- myeyehurtsrn · 2023-10-28 18:07 I use Authy 2FA because it syncs across my devices so I have the codes on my PC & phone. Would definitely recommend! ---------------------------------------------------------------------- ArrogantAnalyst · 2023-10-28 19:43 Ente Auth - an Open Source E2E 2FA Cloud app. It even has a web app. Highly recommended. ---------------------------------------------------------------------- ArrogantAnalyst · 2023-10-28 19:46 Instead of authy, may I suggest Ente Auth. It works the same as authy but is open source. And other than authy, it also allows for the easy export of your 2FA secrets. Authy locks you in with no way to transfer the secrets somewhere else. I recently learned that the hard way when I tried to migrate from authy to Ente Auth. In the end I was successful using a super hacky unsupported method, but it was a PITA. ---------------------------------------------------------------------- Charming_Sheepherder · 2023-10-28 20:09 when you get your totp usually the site gives a qr code and a seed/key you should save one or the other. Also good totp clients like aegis ( FOSS) lets you back up all your keys in an encrypted format and reminds you to back up whenever a certain time has passed or a new totp code is added. then you can save that wherever you want. Itll even import from other totp clients ---------------------------------------------------------------------- mtojay · 2023-10-28 20:28 for semi serious accounts i use the inbuild totps from bitwaren (knowing full well that if someone gets access to my bitwarden he gets access to those accounts) for super serious accounts i use yubikeys (3x) with fido2 if supported and if not at least totp through yubikey with their app. ---------------------------------------------------------------------- SilentDis · 2023-10-28 20:38 Depending on the self-hosting app, there's usually a way to reset an account from the console. It may be quite involved (editing weird conf files or the like), but there is one, in most cases. This goes into your 'bible'. Your "Systems Bible" is every change you've made to every system in one place. router-config.txt >My router is configured by going to IP x.x.x.x > >The config backup is named 2023-10-28\_router-config.conf > >The general idea is to run most things from DHCP and have static IPs handed by this config media-server.txt >I'm running Emby/Plex/etc. on IP x.x.x.x, handed out by static DHCP from router. > >NGINX proxy routes name.domain to it on port 8096. NGINX Proxy manager takes care of SSL. > >User accounts are in SQL database x, or you can use command y to set it directly. > >There's a backup of the config in 2023-10-28\_media-config.conf Every time you make a change to a configuration, you take some quick notes about it. Store passwords in a password locker. Push ssh keys around to handle console auth. ---------------------------------------------------------------------- this_is_me_123435666 · 2023-10-28 22:11 Host bitwarden ---------------------------------------------------------------------- lucamasira · 2023-10-28 22:14 I store the totp secrets in my keepassxc as well. Works great. ---------------------------------------------------------------------- JunglistFPV · 2023-10-29 00:43 Might I recommend Aegis. https://github.com/beemdevelopment/Aegis Can encrypt your seeds, export them encrypted or unencrypted. Love it. I just copy it manually to my NAS when I add a new token (not that often) after exporting it encrypted. In addition to this I also load it on my old phone just in case. ---------------------------------------------------------------------- Winkington · 2023-10-29 00:47 You can also save then in keepass as an attachment. ---------------------------------------------------------------------- wally40 · 2023-10-29 00:57 I self host Vaultwarden and when adding the QR, I add it to my free account with LastPass Authenticator app at the same time. Both back up so if my phone dies, I don't lose the 2fa. ---------------------------------------------------------------------- StrykerSigma · 2023-10-29 03:16 Ente is not selfhosted, you still have to sign-up on the ente site. ---------------------------------------------------------------------- guptaxpn · 2023-10-29 03:55 Which is exceedingly dumb IMHO. Sure it would be a vector, but it's a vector to something that should be an additional step to username and password. Idk, I use vaultwarden and find myself worrying less about "what if?". I'm also enabling TOTP far more often now that I can easily add it to my phone and have it sync to other systems. ---------------------------------------------------------------------- WiseSink7690 · 2023-10-29 04:27 Well, Google Authenticator allows you to backup your codes into your Google Account, so you just need to be sure that your google account is accessible if your device is lost or stolen. ---------------------------------------------------------------------- ArrogantAnalyst · 2023-10-29 05:30 Yes. Open source does not necessarily imply self hosted. ---------------------------------------------------------------------- ocdtrekkie · 2023-10-29 07:00 If you store your passwords and your 2FA tokens in the same place, you have 1FA. Please don't do this. ---------------------------------------------------------------------- ocdtrekkie · 2023-10-29 07:00 I print 'em. Good luck hacking the pile of paper they're in. ---------------------------------------------------------------------- horkyze · 2023-10-29 07:18 Use the aegis authenticator. Its opensource an you can setup periodic export of encryptrd 2fa vault. Then you can integrate it into your existing backup flow ---------------------------------------------------------------------- ttlequals0 · 2023-10-29 20:00 Works well https://2fas.com/ ---------------------------------------------------------------------- this_is_me_123435666 · 2023-10-29 21:34 it does if its truly hosted ---------------------------------------------------------------------- d662 · 2023-10-30 00:24 I have yet to find a good full backup option for Android devices. ---------------------------------------------------------------------- ArrogantAnalyst · 2023-10-30 07:31 Nope, that is completely wrong but I don’t also don’t have the motivation to explain this to you any further. ---------------------------------------------------------------------- TheFluffiestRedditor · 2023-11-01 11:32 Bitwarden != MFA device. ---------------------------------------------------------------------- this_is_me_123435666 · 2023-11-01 14:25 It has MFA feature, check again. ---------------------------------------------------------------------- TheFluffiestRedditor · 2023-11-02 10:08 Bitwarden can provide/host an MFA service? Huh, well how about that.