Comment on Authy got hacked, and 33 million user phone numbers were stolen
9point6@lemmy.world 4 months agoWell yes, the most secure way would be a single source of OTPs, however I’m happy to compromise that slightly for convenience. Having 3-4 devices with access to the OTP database isn’t a huge increase in my attack surface. An attacker would still need to steal one of my devices, rather than one specific device. Those devices would also naturally be protected by additional factors.
I understand I would have to handle the syncing of the database for aegis, I was more curious if you knew of other clients that could use the same database format on other platforms.
I’m very aware it’s a bad idea to keep your OTPs in the same database as your passwords (and in fact already make use of keepass). I would probably not even sync the databases using the same mechanism
Bitwarden/vaultwarden does seem to be the front running option if there aren’t suitable clients for reading an Aegis database on other platforms, and I’ll just ignore the password manager aspects of it even if that means it’s a heavier solution than I’d have preferred.
Thanks for bearing with me on this
Creat@discuss.tchncs.de 4 months ago
As far as I’m aware, the aegis database format is only used by them. You also can’t do an automatic import (only export), so keeping multiple systems in sync (particularly more than 2) can only be tedious.
If that’s what you’re after, just use a KeePass database, in particular if you’re already using one anyway. Most clients can sync with a remote storage (like Keepass2Android or KeePassXC on multiple platforms), and I do mean real sync: Both sides can have modifications, and it’ll consolidate them correctly (of course unless both have modified the same entry, then you’ll be prompted). Just throw the database onto a nextcloud or something, as the clients can also usually talk to that directly without another app doing the file transfer (at least Keepass2Android can).
BitWarden has a pretty good reputation, and is a frequent recommendation as well. But then again, so was Authy… With your own VaultWarden as the backend (if you can easily host that yourself) it would be a no brainer as a near universal solution. And this would probably also be “secure enough” for normal, everyday purposes. It can import and export a KeePass database btw, if that helps.
Since I haven’t actually said anything about how I’m handling this, here’s a quick summary: Critical accounts use a complex password (stored in my password manager) and the 2FA is only stored in Aegis. There are generally backup codes on paper stored “somwhere safe”, if this is supported by the service (google does, steam does, …). On any account that just happens to require 2FA, but I don’t use it for anything critical, the TOTP is just stored inside my password manager, for convenient auto-filling. Examples are a Twitch account (I don’t stream, I just happen to have an account for chat and stuff). My password manager is also KeePass-based and used on multiple systems, sync’d via nextcloud and with a mf’er of a password (plus an additional factor). I generally don’t reuse passwords anymore, at all, ever: They are generated, at least 24 characters long (usually longer) unless the service prohibits passwords of that length (yes, this happens, surprisignly often actually). The password database is of course backed up in like 3+ different locations, and some are located somewhere physically different (i.e. not at home).