2FA Section

[freddy-m]

Description

A section dedicated to two-factor authentication (2FA). Potenial software to include could be:

• Aegis Authenticator
• andOTP

---

This page could also be used as a template: https://thenewoil.xyz/mfa.html

[GintokiHub]

Authenticator Pro by jmh - seems to be updated constantly ,
it's also on f-droid & here : https://github.com/jamie-mh/AuthenticatorPro

[dngray]

I would go to Aegis Authenticator. Some time ago @lynn-stephenson looked into this and determined the password encryption was better on Aegis.

afaik andOTP uses a heap of rounds of PBKDF2, and when you have a lot of passwords it opens really slowly.

[dngray]

On iOS I usually recommend: "Authenticator"

• https://mattrubin.me/authenticator
• https://apps.apple.com/us/app/authenticator/id766157276
• https://github.com/mattrubin/Authenticator

[freddy-m]

@dngray I use Aegis and love it! I'll take your word for the use of "Authenitcator" for iOS.

[dngray]

I don't personally have an iOS device, so would rather go with what native iOS users think is best.

It just happened to be one authenticator app I know of that was open source.

[danarel]

I would highly recommend Ravio OTP as well

https://github.com/raivo-otp/ios-application

[dngray]

I didn't know this was open source actually. I don't have an iPhone/iOS devices. @danarel are you still using this?

[ghost]

I didn't know this was open source actually. I don't have an iPhone/iOS devices. @danarel are you still using this?

It is source available but not open-source.

Quoting AnonC from Hacker News.

To add something about this app, I know that people understand “open source” to mean different things. In the case of Raivo, the app is a “source available” one. It’s not FOSS.

The license [1] says:

Modification, duplication or distribution of this Service (in source and binary forms) for any purpose is strictly prohibited.

Here's their license page if you want to look at it.

https://github.com/raivo-otp/ios-application/blob/master/LICENSE.md#license

[danarel]

I didn't know this was open source actually. I don't have an iPhone/iOS devices. @danarel are you still using this?

Yeah, it's my daily 2FA for a while now. But yea, worth noting it's not FOSS, but source available.

[dngray]

If there are no other good options, then we might have to recommend this.

[ghost]

+1 on Aegis. They use AES-GCM and scrypt for encryption, have nice and clean design, and simple yet comprehensive documentation where they outline that they have considerations to move to more stronger Cryptographic primitives such as AES-GCM-SIV or XChaCha20-Poly1305 for encryption and Argon2 as a KDF. Source

The project is licensed under GPL v3.0, currently Android only, and the last release was over 2 months ago and the developer(s) is active.

Official Website

---

Some Notes on other applications

andOTP (Android): Uses AES-GCM and PBKDF2 with HMAC-SHA1 for backup encryption. Not sure what it uses for application encryption. Last release was over 2 months ago and the developer(s is active. Licensed under The MIT License

---

Raivo OTP (iOS): They use AES-256 and PBKDF2 for encryption. Last release was 8 days ago and the author(s) is active.

Not exactly FOSS

Modification, duplication or distribution of this Service (in source and binary forms) for any purpose is strictly prohibited. - Source

---

Authenticator (iOS): Not sure whether the application supports encryption. Last release was over 2 years ago and the developer(s) seems active. Licensed under The MIT License.

Official Website

---

Tofu (iOS): Not sure whether the application supports encryption. Last release seems to be over 8 months ago and the developer(s) is active. Currently doesn't seem to allow exporting codes which is a concern. Licensed under the ICS Lincense.

Official Website

[nourkagha]

Slight typo correction: Raivo OTP is iOS.

[ghost]

Slight typo correction: Raivo OTP is iOS.

Fixed!

This is what I get for copy pasting the same template.

[freddy-m]

Based on this discussion, we should list:

• Aegis
• andOTP
• Raivo OTP?

cc @privacyguides/team

[nourkagha]

I wouldn't bother mentioning andOTP. I don't see any good reason to recommend that.

Agreed. I see no reason and don't understand why someone would use andOTP over Aegis which is a more mature app security-wise with more cryptographically experienced developers and a better and richer UX with more features.

Relevant thread: https://www.reddit.com/r/androidapps/comments/b45zrj/dev_aegis_authenticator_secure_two_factor/ej4g6ll/

[dngray]

I think this is ready to proceed. to a PR now. I think we're pretty much all in agreement. I'd mention Aegis and Ravio OTP as the two options. Regarding the Aegis code, I'm pretty sure @lynn-stephenson looked at the Aegis code in some detail with an audit.

They were going to publish their findings, but I'm not sure if they did.

[BraINstinct0]

Seems like @lynn-stehpenson committed the report on Aegis v1.1.4 to his repo.
Conclusion of the audit:

No obscure, vulnerable, or broken cryptographic primitives are present in the design. Reasonable parameters were chosen for the cryptographic primitives. Implementation of the design is solid.

Key management is superb, preventing loss of the vault should Android's Key Store be wiped, or biometrics disabled prior to disabling the feature in the app. The UI is minimal, easy to use, and supports importing 2fa tokens from other apps, resulting in a good UX.

[BraINstinct0]

Problem is, that's for version 1.1.4 and the current stable/recommended version (on F-Droid) is 2.0.2..

[thomassth]

I would say for the sake of consistency, unless they are served as separate/standalone authenticator applications, it would be best for TOTP functionality within password managers like KeePassXC and Bitwarden (albeit behind a Premium subscription) to be noted (if it isn't already) in the description of these applications in the password management section.

For KeePass its fairly easy to open and use a second database. This is a plus for keepass in OTPs, beside platform interoperability.

Or in my case, I use another password manager for passwords, and open a keepass database just for my OTPs.

[3k2]

as for IOS users do we really need to use third-party 2FA app because IOS 15 has now built in 2FA in the password section?

[danarel]

as for IOS users do we really need to use third-party 2FA app because IOS 15 has now built in 2FA in the password section?

Yes because it doesn't function as a standalone app. So if I am on my laptop and need my 2FA code, I cannot use iOS 15 to get that code. You need a third party app to manage that.

[3k2]

I haven't tried it myself but can't you view it in the password section?

[danarel]

Technically yes you can go there and get it, but I don't think it's a very user friendly alternative. Anytime you need a code you have to go to Settings > Passwords > the app > authentication code.

Also, this means you're storing your passwords and codes with Apple. This same argument would mean the site shouldn't bother offering password managers for iOS because it has one built in as well.

The whole point of this site is to offer privacy alternatives away from the tech giants.

[3k2]

What about strongbox? you can also setup there 2FA logins if you want.. my issue with some of these suggested 2FA apps are that they aren't being updated like Authenticator last update is 2019. But as for myself I have been using Authy seems to be getting frequent updates.

[Mikaela]

In case it's of interest to participants of this discussion, I also opened a thread for hardware 2FA section: https://github.com/privacyguides/privacyguides.org/discussions/156

[thomassth]

Not many people do it this way, but I manage my 2FA with a separate KeePass database.

Since each 2FA record is just an entry to kdbx, security is expected to be good with to all the improvements over the years and active participation in the community.

Also, I can be sure that my 2FA entries won’t be inaccessible if I move away from one app to another, since there are so many apps for KDBX and basically covers all platforms.

One drawback would be the 2FA support depends largely on the app. I’m currently using Keeweb and keepassDX on my phone, both with good support on 2FA. KeepassDX can even show my 2FA codes on the main page, making it on par with other 2FA apps.

[TommyTran732]

Not in favor of this. Passwords should be kept separated from the 2FA tokens. If either the password or 2FA database gets compromised, and you keep them separately, you are still fine. If you put them into the same basket however, you are pretty much screwed.

[thomassth]

you can create and open multiple kdbx-es
so in best practice, just open one with your password, and another with your 2FA
and they can share the file format and any security enhancement of it

[BraINstinct0]

To include in the Avoid/be aware list, I thought it's beneficial to list a few 2FA/MFA applications that people usually come across first(at least based on what I/my friend(s) have experienced.)

• Google Authenticator(a.k.a. Google OTP)
• MS Authenticator
• Authy (one that seems to be recommended frequently when someone says I'm afraid I'll lose everything when I change my phone - but, Authy requires a phone number to use it. That number is associated with the account across all devices. Besides, no source disclosed + acquired by Twilio)

I see these as ones to avoid, but it'd be worth mentioning since the main target of privacyguides.org - ppl rather new/fresh to privacy will have those three in mind(well, at least for me).

[BraINstinct0]

Might be worth adding to the list: LastPass Authenticator, and LastPass MFA. Seems like it's used quite a lot on Android, at least judging by the download counts.
My opinion: Should be avoided for the same reason as LastPass itself.

[dngray]

Fair to say I think this one is resolved https://www.privacyguides.org/basics/multi-factor-authentication/

[jnton]

You should add Authenticator Apps criteria.