Hacker News Reader

Hacker News

Comment by teedog | Hacker News Reader

Full thread

teedog

Just migrated in bulk from Authy to Aegis Authenticator (open-source with encryption and automatic backups/exports).

Instructions:

https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d...

Aegis-specific export:

https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d...

View on HN

I love Aegis. Note how insane the Authy export instructions are. "Paste in a bunch of code to an Electron app running Authy in debug mode to dump the tokens as QR codes". It works but :yikes:

Aegis has a nice clean encrypted import/export JSON format.

I did this yesterday as well, Aegis seems really nice. I've got Syncthing up and running with my desktop as a middleman, so my old phone can be whipped out at any time if my current one gets stolen/lost/bricked.

But now I am wondering if I should be re-seeding across all my TOTP-enabled accounts in case we continue to be drip-fed new information about how much worse this breach is getting.

I've triggered the deletion process for my Authy account - the claim is that all my info will be deleted after 30 days.

another vote for Aegis, its fantastic but Android only.

Any tips for iOS users?

I use Microsoft because they tend to have a good security development lifecycle.

I like OTP Auth. Strongbox also has it built into the password manager if you wouldn’t mind that.

If you're already using 1Password, it supports OTP.

Probably not worth buying it just for that feature, but I'm a happy user.

I sorta prefer having it in something separate from the passwords, though. If my 1PW gets compromised, so do the 2FA secrets stored alongside the passwords.

KeepassXC has OTP functionality but it's very clunky as the URI needs to be crafted. I usually copy the OTP string from another credential and edit the code and name.

Bitwarden has TOTP with a paid plan.

There’s also OTP Auth, which is a freemium app with all the basic needs covered in the free option, including an Apple Watch app/Watch Face complication.

Would you recommend using Bitwarden TOTP if you also have access to Yubikeys? I'm uncertain what I would like to transfer to as I'm a long time user and like Bitwarden though am working on trying to self host it and have yubikeys but manually scanning and naming twice to have the TOTP for something like discord or really any website which doesn't have near direct access to financials or private documents seems particularly annoying so if Bitwarden can act as the TOTP that seems like a solve 2 problems with one stone for lower security requirement accounts.

An open-source alternative I was suggested for iOS is Raivo OTP.

https://raivo-otp.com/

Reply on news.ycombinator.com