Aegis
Comment on Authy got hacked, and 33 million user phone numbers were stolen
net00@lemm.ee 2 months ago
Now that authy has fucked us over with this, what should I move my 2fa codes into, any recommendations?
Unfortunately I can’t use aegis on iOS/windows, does keepass have this functionality?
foremanguy92_@lemmy.ml 2 months ago
snek_boi@lemmy.ml 2 months ago
These are not local solutions, but are cross-platform and open source: Bitwarden or Proton Pass.
lud@lemm.ee 2 months ago
Doesn’t synced solutions completely defeat the purpose of MFA?
JasonDJ@lemmy.zip 2 months ago
Not if you protect the master key with MFA, like a yubikey. Then it’s cryptographically secure for quite a while…at least until quantum computing is affordable enough to be used against your data.
snek_boi@lemmy.ml 2 months ago
You’ve got a good point. I wonder if this an example of a trade-off between convenience and security. If you’re logging in and you get an MFA prompt, a Yubikey has to be physically searched, while Bitwarden or Proton Pass only have to be clicked. A Yubikey can only hold a limited amount of accounts, while Bitwarden or Proton Pass could hold many more. Of course, a Yubikey could be used as MFA for Bitwarden or Proton Pass, but that would create a single point of failure and reduce factor separation (which I think is your original point).
While I posted a Bitwarden or Proton Pass recommendation of sorts, I genuinely wonder if it’s advisable to not use MFA at all if the factors will not be separated. Or, perhaps, the best security solution is the one you’ll actually use. I guess the answer is the good ol’ “What’s your security model?”
Passerby6497@lemmy.world 2 months ago
I wonder if this an example of a trade-off between convenience and security.
I genuinely wonder if it’s advisable to not use MFA at all if the factors will not be separated. Or, perhaps, the best security solution is the one you’ll actually use
Your first and last statements are correct. Using your password manager as your MFA is a trade off with security and convenience, but that added convenience helps make it more usable so you actually use it. Anything is a trade up for most peoples’ awful password hygiene, so the trade off is worth it in my opinion.
Regarding the advisability of combining password and MFA into one platform: while you are lowering the overall security of your accounts, if you secure the main account with a long/strong password and a hardware security key, I would say that’s still more secure than not having 2FA enabled or not using secure passwords.
Natanael@slrpnk.net 2 months ago
Most KeePass clones have it now, i use Keepass2Android plus KeePassX on PC
AbsoluteAggressor@lemmy.dbzer0.com 2 months ago
padge@lemmy.zip 2 months ago
I like 1Password’s built in MFA support, if it’s a really sensitive account I use Google Authenticator because I haven’t bothered researching better local alternatives
mint_tamas@lemmy.world 2 months ago
You are not any more secure with google authenticator for 2fa, are you?
padge@lemmy.zip 2 months ago
Possibly not now that it saves your codes to your google account (it didn’t use to), but it made me uncomfortable for my password manager to have both factors together to log into something like my bank or root AWS account. So you’d have to compromise two different places to get in
Veraxus@lemmy.world 2 months ago
Most decent password managers (e.g. 1Password, Proton Pass) have MFA built-in. Use those.
ruse8145@lemmy.sdf.org 2 months ago
I use this on my windows machines, offline , has biometrics, supports export and import from aegis.
Clandestine@lemmy.zip 2 months ago
I’d recommend 2FAS Auth
azalty@jlai.lu 2 months ago
Yup it’s pretty good, although I would’ve liked it better if they provided a good way to export the data to another app
Tick_Dracy@lemm.ee 2 months ago
NotMyOldRedditName@lemmy.world 2 months ago
Buy a few (at least 2 for a backup) yubikeys.
Much more secure.
You can store the TOPT codes on them, but then you can also do all the higher security things too.
Cyberjin@lemmy.world 2 months ago
I’m using aegis, but maybe Proton Pass could be good?
sem@lemmy.blahaj.zone 2 months ago
It’s good
HEXN3T@lemmy.blahaj.zone 2 months ago
USB keys. Good luck getting one of those hacked.
krash@lemmy.ml 2 months ago
To be more concrete: security keys can communicate over USB or NFC. Just make sure it supports the protocol you want to use it for.
But there is also passkeys which is both software- and hardware based and is almost equally secure.
Mothproof3007@programming.dev 2 months ago
KeePassXC does have this functionality on desktop as well as on SOME android apps (no idea for iOS). For android I like KeePass2Android Offline, iirc it was recommended on the official KeePassXC website (you may want to check it out).
CaptPretentious@lemmy.world 2 months ago
Bitwarden would be my vote
kahdbrixk@feddit.de 2 months ago
Just out of curiosity: is it wise to keep you MFA within your password safe? Like is that not the opposite of multi factor? I’m no troll, I’m seriously uninformed.
AProfessional@lemmy.world 2 months ago
Realistically the threat we care about is others leak your password. So it doesn’t matter.
If you have a setup where your password vault is at risk the. Yes it’s a bad idea.
CaptPretentious@lemmy.world 2 months ago
I suppose there is a certain level of risk but that’s true with any solution. Passwords generally don’t get changed very often and that’s usually what’s going to be nabbed up by somebody that in your username of course. With TOTP, putting that in bitwarden means that in order to get access to whatever account, they first have to get your credentials which they probably got from a dump filled with a bunch of other credentials, then I’d have to figure out that you’re using bitwarden was your be no sign that you are. Then they’d have to actually get into your bitwarden which if you’re doing it properly should be difficult. And if the login to bitwarden is completely different than the account are trying to get into it’s basically invisible to them.
The only way I see bitwarden being the weak link, is 1. Someone has physical access to your devices and they know what they’re looking for (in this case it’s probably a roommate or family or friend, someone that you trust but probably shouldn’t). 2. Bitwarden gets compromised (which is an impossible but it is probably more difficult because it is an open source thing). 3. You go to shady website and install shady stuff and that install some sort of keylogger, or something else that shows what your system has (hell, Microsoft recall would actually fall into this category) and a back actor sees that you have bitwarden and how you log into it. But that being said, 1 and 3 aren’t necessarily stopped by having a password manager solution and the separate MFA solution… But it could slow them down.
But physical MFA isn’t impervious either. I don’t recall if it was yubiki or Google’s Titan, if I remember back years ago one of them had a problem.
riplin@lemm.ee 2 months ago
I’ve been running a self-hosted Vaultwarden server with Bitwarden clients. It’s been perfect. The clients could use some usability work, but other than that, no complaints.
geography082@lemm.ee 2 months ago
This