Beware: Authenticator app issues

Aegis Authenticator is a free and open source 2FA app that supports both HOTP and TOTP algorithms. Since they are the most used open reference architectures backed by Initiative for Open Authentication, there is no need for any kind of "authorization" to use Aegis for managing 2FA codes for different platforms.
Aegis does not require internet permission and requires only 3 permission to operate. Very safe and privacy friendly.

1657283840352.png


You can download it from Google Play or F-Droid Store. https://f-droid.org/en/packages/com.beemdevelopment.aegis/

The code is available to inspect and reproduce. https://github.com/beemdevelopment/Aegis and it is recommended by PrivacyGuides. https://www.privacyguides.org/multi-factor-authentication/#authenticator-apps

You can set Aegis to auto backup to any folder on your android device -> Google Drive / OneDrive / Syncthing, etc.
 
Adding the screenshot of the landing page of Microsoft Authenticator with the restore option for reference.

Edit: Photo, since screenshot is blocked.
 

Attachments

  • Authenticator.jpg
    Authenticator.jpg
    367.9 KB · Views: 95
It's not cross platform though. AFAIK it's Android only.
Should have realised upfront that free open-source apps don't have any incentive to pay Apple $99/year.

On that note, really stupid of Microsoft to not support Windows with Authenticator. Presently use it with the Android subsystem on Windows but makes no sense.
 
I knew that while enabling 2FA on any app/site, it shows us 8 digit backup codes which we need to store/note down in a secret. I have few codes for few such apps/sites but majorly I dont have as thought Google baba will take the pleasure as always to sync them all inside Google Authenticator.

So, learnt my lessons, hence urging everyone to backup those 8 digit backup codes and store them handy.

FTW I have disabled 2FA on most of the apps and looking for an Authenticator app which can backup everything configured!
So that's the moral of the story. Back up those codes if you use 2FA.

Why have you disabled 2FA though ? lesson learnt no ?
 
On that note, really stupid of Microsoft to not support Windows with Authenticator. Presently use it with the Android subsystem on Windows but makes no sense.
Yeah I was quite surprised at how badly Authenticator was integrated with Windows. Passwords synced to Edge and that's about it. It says something when iCloud Keychain for Windows provides a better experience.

Are open-source 2f apps even secured, any backdoor thing?
Apps like Aegis provide the best security but you miss out on the convenience factor. You don't get cross platform support, multi-device sync and easy to use cloud backups with recovery options. Sure you can upload the encrypted backup files to a local or cloud location of your choosing but it's not a seamless experience.

You have to decide whether you prefer security above all or prefer a reasonable amount of security with a convenience factor. And nothing is stopping anyone from using multiple 2FA apps. If something needs to be kept highly secured you can use the safer but less convenient app for that.
 
Last edited:
Bet OP missed that. Yeah i can see why
I anyways was not concerned for MS auth app as only my organizations a/c and my personal MS a/c was configured which can anyways be resetted and alternatively logged in and if not then there is toll-free thing.
SO finally giving Aegis a try.
 
For microsoft accounts, i use microsoft authenticator and authy for rest all due to the support of apple watch, as well multi device support.
 
No love for bitwarden? Their 2fa feature is paid, but that's 10usd/year. It syncs across devices and auto enters/copies the 2fa code to clipboard. For added privacy you can even self-host an open source implementation of their backend (vaultwarden).
 
No love for bitwarden? Their 2fa feature is paid, but that's 10usd/year. It syncs across devices and auto enters/copies the 2fa code to clipboard. For added privacy you can even self-host an open source implementation of their backend (vaultwarden).
What's the point of having 2 step auth if you keep both steps locked down in the same place.
----
Google auth is a shit app. I wonder do users not read reviews or see the bad ratings before installing any apps?
 
Authy has been my default authenticator app for the past couple of years. The multi-device option that it has is all I need to ensure continued access to Authy even when upgrading or reinstalling OSes in mobile or laptop.
 
Another casualty by Google authenticator :(

Like everyone said, Use Aegis or AndOTP. Both are OSS applications and implement TOTP/HOTP RFCs. They can encrypt seed phases and back them up to Cloud. Authy is also a decent option. Microsoft authenticator is just not fast compared to the 2 oss apps.
 
No love for bitwarden? Their 2fa feature is paid, but that's 10usd/year. It syncs across devices and auto enters/copies the 2fa code to clipboard. For added privacy you can even self-host an open source implementation of their backend (vaultwarden).
Lol! who even pays for such thing. 10$ lifetime is fine but per yr is a joke for any aam aadmi.
 
Lol! who even pays for such thing. 10$ lifetime is fine but per yr is a joke for any aam aadmi.
Lifetime licenses only works if the product can be run locally and the devs don't need to maintain a server for it. Since product like Bitwarden require ongoing cost to run, there's no sense in lifetime pricing.

$10 per year for the services they are providing is actually reasonable. It does get inflated for us, due to the exchange rate, but their costs are in USD, and so is their price.
 
Lifetime licenses only works if the product can be run locally and the devs don't need to maintain a server for it. Since product like Bitwarden require ongoing cost to run, there's no sense in lifetime pricing.

$10 per year for the services they are providing is actually reasonable. It does get inflated for us, due to the exchange rate, but their costs are in USD, and so is their price.
Still paying for something which has many free alternatives with flexibility of local backup etc. makes sense unless someone is too much specific on cloud.
 
Still paying for something which has many free alternatives with flexibility of local backup etc. makes sense unless someone is too much specific on cloud.
Bitwarden does offer a free service but you do not get TOTP as part of that. For that, You need to pay 10 USD/year. It's literally dirt cheap compared to others and god help us if you think paying a minimal amount like this for a security critical product is them asking too much.
Bitwarden Premium features list, https://bitwarden.com/pricing/
 
Back
Top