What authenticator app do you use? How do you backup? Any open source self hosted options?

  • Deys@lemmy.one
    link
    fedilink
    English
    arrow-up
    45
    ·
    1 year ago

    i use aegis, it is open source and does not have internet access. you can export and import your secret codes and it has an automatic local backup. it automatically creates a backup of the vault to external storage when changes are made. to backup my vault i use rclone with encryption to backup it to google drive. i also made a termux shortcut script that makes a copy of my vault to sd card.

    • animist@lemmy.one
      link
      fedilink
      English
      arrow-up
      7
      ·
      1 year ago

      +1 for aegis. Keep my secret codes in an encrypted backup file just in case

    • NightOwl@lemmy.one
      link
      fedilink
      English
      arrow-up
      4
      ·
      1 year ago

      Aegis is what I use too. I feel more comfortable with local backups which is why I went for it over those with cloud sync integration.

    • Dusty@lemmy.dustybeer.com
      link
      fedilink
      English
      arrow-up
      2
      ·
      1 year ago

      I switched to aegis a while ago, it’s been one of the best apps I’ve used for authentication. I was using Authelia for along time before that but my backup stopped working unbeknownst to me. I found out while doing a regular backup/restore test it had borked itself.

  • pvr@beehaw.org
    link
    fedilink
    English
    arrow-up
    21
    ·
    1 year ago

    I use Bitwarden (I know opinions are split when it comes to passwords and 2FA being in separate apps). But I like the convenience of it all being in one platform.

    I also like Raivo, you can import/export them too.

    • sabre3999@kbin.social
      link
      fedilink
      arrow-up
      6
      ·
      1 year ago

      You can set Bitwarden to require your master password for higher security logins. I keep a separate vault for work and personal things… Everything in my work vault requires it’s master password to use them. The OTPs are useless without credentials, and you need the master password to get at those even when the vault is unlocked. YMMV but to me, this was “good enough” to ensure a separation of concerns between low and high risk.

      • DarthRedLeader@lemmy.world
        link
        fedilink
        arrow-up
        1
        ·
        1 year ago

        This is the first time I’m hearing about this feature and am interested. But I feel like it would be better to use a different password than your master for these higher security logins. The thought being that, if someone has access to your passwords, they likely have access to your master password as well, unless they had access to an already unlocked vault.

    • Freeman@lemmy.pub
      link
      fedilink
      English
      arrow-up
      5
      ·
      edit-2
      1 year ago

      I use bitwarden and only put totp codes in it for “low risk” uses. Like say…a Reddit account.

      Thinks like email accounts or ones associated to bank etc I keep in google Authenticator (not synced to the cloud)

      I also keep a spare phone with the google auth totp codes loaded in case I lose my phone.

      At the service level I also keep backup codes or use a yubikey when possible. So even MFA at the account level often has options, even if it’s “my phone is across the room and I’m too lazy, backup code time”

    • kalipike@lemmy.one
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 year ago

      I also use Bitwarden both for passwords and TOTP. I secure it with password + Yubikey. Works well enough it seems! If I ever have any concerns I’ll move TOTP to Aegis in a heartbeat though.

  • MrTHXcertified@kbin.social
    link
    fedilink
    arrow-up
    13
    ·
    1 year ago

    Authy for OTP, Bitwarden for passwords.

    As long as my provider shows some concern for the sensitivity of the data I entrust them with, I’m good.

    • roving6478@kbin.social
      link
      fedilink
      arrow-up
      8
      ·
      edit-2
      1 year ago

      I use Bitwarden for both passwords and TOTP. So much easier than messing around with multiple apps.

      • NaN@lemmy.blahaj.zone
        link
        fedilink
        arrow-up
        1
        ·
        edit-2
        1 year ago

        I trust Bitwarden but putting it all into one place still sketches me out. I only use their TOTP for low impact stuff where convenience trounces security, otherwise it’s Authy with device enrollment off, and on a yubikey.

    • 1bluepixel@kbin.social
      link
      fedilink
      arrow-up
      4
      ·
      1 year ago

      Yeah, that’s my setup as well. Tech-savvy people tend to have an all-or-nothing attitude to security, but at the end of the day, as soon as you take some extra precautions like using a keygen or activating 2FA, you’re already taking yourself out of the massive pool of targets of opportunity that hackers go for.

    • sabre3999@kbin.social
      link
      fedilink
      arrow-up
      3
      ·
      1 year ago

      Same here, though I’m starting to move my OTP over to Bitwarden as well. Way more convenient - as a developer, I spend a lot of time off my phone. Makes more sense to let Bitwarden manage those so I don’t have to pick up my phone as often.

      I’m also slightly distrustful of closed-source Authy, whereas Bitwarden is open source and audited for security by third parties.

    • whofearsthenight@kbin.social
      link
      fedilink
      arrow-up
      1
      ·
      1 year ago

      Same setup here, though since i’m on basically all Apple devices when iOS 17 public beta is out I’m going to switch to just using the built in manager. Supports two factor, and the main achilles for me was that I couldn’t share passwords, but that’s fixed for 17.

      • MrTHXcertified@kbin.social
        link
        fedilink
        arrow-up
        2
        ·
        1 year ago

        I’ll be sticking with Authy/Bitwarden for the near future since I float between devices of all types – Windows, iOS, Android/ChromeOS… (Not that I mind. It avoids the whole “eggs in one basket situation”).

        I am eagerly awaiting greater support for passkeys. Now if only enterprise apps could get on board with that!

        • Jarmer@kbin.social
          link
          fedilink
          arrow-up
          2
          ·
          1 year ago

          I’m pretty much in exactly the same situation. I don’t like using authy but haven’t really come across a foss equivalent.

  • JCreazy@midwest.social
    link
    fedilink
    English
    arrow-up
    8
    ·
    1 year ago

    I use andOTP but I didn’t realize it wasn’t in active development. I might give aegis a try. I have a yubikey and once I get a second one I may move everything to that.

    • TurboRotary@kbin.social
      link
      fedilink
      arrow-up
      4
      ·
      1 year ago

      I switched from andOTP to Aegis when I found out about the development and I actually like it more! I was able to import all my saved credentials easily.

  • haych@lemmy.one
    link
    fedilink
    English
    arrow-up
    8
    ·
    1 year ago

    I was on Authy, but painfully migrated to Aegis. I keep a backup on my NAS just in case.

    I think Authy was the better app, and good with it working on my PC, but Aegis is more secure so that won.

  • Ryan@discuss.tchncs.de
    link
    fedilink
    English
    arrow-up
    8
    ·
    edit-2
    1 year ago

    Aegis is a good one for Android. I use the totp field in my keepassdx database that I open with a password (or fingerprint) and my yubikey to store my auth codes. I use this with syncthing running on a raspberry pi so it syncs the password database across my phone and all my computers.

    Edit: initially said keepassXC I meant keepassdx for the mobile app. Xc is the desktop version.

  • DarthRedLeader@lemmy.world
    link
    fedilink
    English
    arrow-up
    8
    ·
    1 year ago

    I use Aegis, which automatically backs up with each change to the database to a folder that gets synced to a couple of different computers via syncthing.

    For backup codes, I have a separate keypass database that’s backed up to a couple of places. I thought about using Bitwarden for this backup, but having my 2FA backups in the same place as my passwords kinda defeated the point, IMO.

    Anyway, this system has worked well for me.

  • divinely_splashing@lemmy.worldB
    link
    fedilink
    English
    arrow-up
    7
    ·
    1 year ago

    Yubico Authenticator and Aegis depending on the importance of the account. I have a secondary Yubikey for quick access backups and a keepass database exclusively for my TOTP keys that I backup to my nextcloud server in real time with versioning. Similarly, I backup my Aegis backups with the nextcloud app.

  • Vanon@lemmy.world
    link
    fedilink
    English
    arrow-up
    5
    ·
    edit-2
    1 year ago

    2FAS, because it’s fucking beautiful (UI, dark mode, lovely site logos). It has a couple backup options. Also using Bitwarden (paid feature) for less important sites; it’s quicker but I prefer my 2FA truly separate from passwords.

    • AngryDemonoid@lemmy.lylapol.com
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 year ago

      This looks great! Was going to give it a try, but it doesn’t pull in the service name when importing from Aegis. I don’t want to try it bad enough to manually edit every entry. Lol.