Nevertheless I chose my Yubikey instead.
EhrenBVG. Wie immer.
BVG out here recommending the best 2FA Apps!
Submitted 11 months ago by Y2K38@lemmy.one to privacyguides@lemmy.one
https://lemmy.one/pictrs/image/235cf489-75ab-49a8-94c4-01b26f0f1386.png
Comments
ErKaf@feddit.de 11 months ago
QuazarOmega@lemy.lol 11 months ago
Incredibly based.
Come to think of it, it’s sad how we’ve got so accustomed to be suggested Google Authenticator and the other big corp data funnel 2FA appshswolf@lemmy.world 11 months ago
If you get Bitwarden pro (really cheap), you can save an OTP link together with the site credentials, it’s really good for keeping everything in one place
PracticalParrot@discuss.tchncs.de 11 months ago
I do this. I want to point out it is absolutely TERRIBLE for security. It’s turning 2 factor back into 1 factor authentication.
kniescherz@feddit.de 11 months ago
I would argue its more like a 1.5 factor. Not secure when your bitwarden gets compromised. But more security for stolen, leaked, phised passwords.
I currently have 60 OTPs in Bitwarden, I probably would not have activated 2FA on so many sites without BW.
goodhunter@lemm.ee 11 months ago
Consider your threat model. You could use a yubikey for Bitwarden log in.
hswolf@lemmy.world 11 months ago
yeah, while I understand that, it’s not every time I have both my phone and computer together at the same time
using a standalone OTP on either one of them would make the opposite a pain in the ass to use
I take a lot of precautions with my main vault password, even got a biometric reader so I don’t have to type the password that much
IdleSheep@lemmy.blahaj.zone 11 months ago
This isn’t always a good idea because then you’re putting all your eggs in one basket. The whole point of 2FA is that the second factor is in a separate location so if your first factor (password) gets compromised the second one (OTP code) still protects your account. If both factors are in one place you’re back to a single point of failure instead of 2, losing a key benefit of 2FA.
kniescherz@feddit.de 11 months ago
You lose security, sure. But you are gaining so much more ease of use. Bitwarden autofills your credentials and puts your token into your clipboard. Also it syncs your tokens to all devices. Effectifly this makes a site as easy to login as a site without 2fa.
The alternative is on desktop always get your smartphone, open some app type a token or on the phone to switch to multiple apps to get your credentials. Not fun imho.
I currently activated 2fa on over 60 sites, I doubt I would use it as much without BW.
For me, the key benefit of 2Fa is getting more security against leaked, stolen, phished passwords, and that still holds up.
derpgon@programming.dev 11 months ago
If you get Vaultwarden, absolutely free, you don’t have to pay and have full control over your data. It’s a win-win!
SaltyIceteaMaker@iusearchlinux.fyi 11 months ago
Proton pass can also do this
kilgore_trout@feddit.it 11 months ago
BVG is acronym for Berliner Verkehrsbetriebe, Berlin’s public transport agency.
nutbutter@discuss.tchncs.de 11 months ago
In India, they force us to install proprietary apps, which are probably spying on us.
Star@sopuli.xyz 11 months ago
They don’t, though? Who’s forcing you to install a proprietary 2FA app in India. Unless you’re saying in general.
nutbutter@discuss.tchncs.de 11 months ago
My bank, for example, does not let us use any 2FA app we want. They have their own separate app, made for handling 2FA for that specific bank only.
And in general too, yes. Like Arogya Setu. The app we had to install to prove our vaccination status.
aniki@lemm.ee 11 months ago
andOTP is opensource, backs up locally, remotely, encrypted, or unencrypted. has no back doors, and will work with any DFA i can chuck at it.
its an archived project but still works fine in modern android
LWD@lemm.ee 11 months ago
I think I’d rather use a solution under active development, thanks for the rec though
XioR112@lemmy.world 11 months ago
Here is active fork. github.com/helloworld1/FreeOTPPlus
lemann@lemmy.one 11 months ago
This is what I use. Also supports exporting/importing data to and from Gnome Authenticator so you have 2FA on your computer too 👍
aniki@lemm.ee 11 months ago
Sick! I didn’t think to look at the forks but that’s amazing.
OfficerBribe@lemm.ee 11 months ago
Are there well known TOTP apps with backdoors?
aniki@lemm.ee 11 months ago
Anything closed source could have backdoors. Trust no one.
ReversalHatchery@beehaw.org 11 months ago
That depends. More of the popular ones don’t encrypt the secret keys, they can just be read out with root access or even with the use of ADB (the pull command), not even speaking about reading the memory contents while booted to a recovery.
Some even uploads the keys to a cloud service for convenience, and they consider it a feature.
vox@sopuli.xyz 11 months ago
why not 2fas
frogmint@beehaw.org 11 months ago
Why not Aegis?
floridaman@lemmy.blahaj.zone 11 months ago
I self host Bitwarden (Vaultwarden) so I just use the built-in TOTP authenticator in the Bitwarden app. It’s nice to have it all in one place + having auto copy and paste when I log in. And because I self host, it’s all backed up securely and with (as far as I know) no real backdoors.
Winter8593@lemmy.world 11 months ago
No, please do not do this. Two factor authentication should be just that: two separate factors of authenticating yourself. Having them combined in one is the same as one factor.
floridaman@lemmy.blahaj.zone 11 months ago
Said in the reply to the other comment here, but I don’t really self host for security/privacy sake. And in addition to that comment I’d also like to say that I do use a YubiKey when possible for MFA. I’m not a security nut enough to care about TOTP (which kinda sucks anyway) all too much but for important things I do use physical MFA.
Undertaker@feddit.de 11 months ago
Yeah it compromises the idea of a second factor. Bitwarden is the wirst choice. It’s only one thing: comfortable
floridaman@lemmy.blahaj.zone 11 months ago
Fair, although I’ve said in a comment on this account somewhere else, I self host more for convenience sake than anything. I just like having my own password manager, sure it’s not as secure to use it for MFA but it’s better than giving my passwords to Google, LastPass, etc. and then using eg Google Authenticator. Self hosting is more a corporate distrust thing than a privacy thing for me
ideonella@lemmy.one 11 months ago
I do the same thing. And Bitwarden’s 2FA is off my phone. In a complicated world, it’s reasonable to keep 1 password + 2FA as secure as possible. I simply can’t handle the hassle of pulling out my phone for every 2FA login, but still value the protection 2FA + randomly generated passwords provide.
BeatTakeshi@lemmy.world 11 months ago
I went for foss authenticatorpro.jmh.me
CodeGameEat@lemmy.world 11 months ago
That’s the one i use too, really a nice app
Undertaker@feddit.de 11 months ago
FreeOTP+ is the choice not Free OTP…
TheInsane42@lemmy.world 11 months ago
According to (Wikipedia)[…wikipedia.org/…/Comparison_of_OTP_applications] it’s based on google authenticator. Is it known how much google code is still in there?
LWD@lemm.ee 11 months ago
FreeOTP is what you’re talking about, right? It’s “Maintained by RedHat, and based on Google Authenticator.” So it’s under the control of a major open source group. I wouldn’t be worried. It’s not like or Firefox, where fork developers have to play catch-up.
badgrandpa@lemmy.world 11 months ago
only what I don’t like in FreeOTP is lack of passcode or biometrics
BolexForSoup@kbin.social 11 months ago
This is becoming a trend and I really don’t like it.
Y2K38@lemmy.one 11 months ago
What exactly?
BolexForSoup@kbin.social 11 months ago
Setting restrictions on what 2FA/authenticators we can use. I imagine it’s only a matter of time before Google functionally makes it so you can only use theirs when using their services.
vox@sopuli.xyz 11 months ago
2fa
m_r_butts@kbin.social 11 months ago
badgrandpa@lemmy.world 11 months ago
i think they got some google trackers in their code
Truck_kun@beehaw.org 11 months ago
I’d love to know as well.
Been using it for a while as the 2FA app used and recommended by Leo Laporte. I’ve had a good experience with it, but if it has any issues, I would love to know.
LWD@lemm.ee 11 months ago
From what I can tell, 2FAS basically comes with the reasons people want Authy, with only some of the downsides. Cloud sync between devices is neat, but it adds a potential vector for attack (which is just inherent to the process).
noodlejetski@lemm.ee 11 months ago
that’s a refreshing change from the regular Google Authenticator and Authy mentions.
totallynotarobot@lemmy.world 11 months ago
What’s wrong with Authy?
Evotech@lemmy.world 11 months ago
Nothing
vaselined@lemmy.world 11 months ago
Apparently it is hard to export out of authy