4 ms·

I use Authy. I've read a few comments about how migrating away is difficult. What do you use instead? I also use bitwarden, but not sure how I feel about passw

I use Authy. I've read a few comments about how migrating away is difficult. What do you use instead? I also use bitwarden, but not sure how I feel about passwords and totp being in the same app.

drpossum 3y ago
I've moved over to Proton Pass (you can do TOTP on the desktop through a browser, I figured if I'm authenticating into a site I must have internet) but KeepassXC was a strong contender. Both have excellent mobile support and Keepass has native desktop clients. Proton Pass isn't free, though, but I already had their services.
- protonmail 3y ago
  Happy to hear you've switched to our password manager! Just to clarify, you can use Proton Pass for free too: https://proton.me/pass/free https://proton.me/pass/free.
latchkey 3y ago
> not sure how I feel about passwords and totp being in the same app I felt the same way and I've come to realize that it is not a big deal. One advantage is that with a shared password manager account, you can also share the TOTP along with it. Very convenient for a bunch of usecases.
- gukov 3y ago
  Is it really multifactor then, with everything in Bitwarden?
  - latchkey 3y ago
    The way I see it, your password manager becomes the central point of failure. Therefore, secure your password manager with a hardware security key (yubi). Not all accounts stored in a password manager are created equal... some need more security than others. If there are accounts that you want additional 2FA security on, just use a separate TOTP app. It doesn't have to be an all or none option.
    - deleted 3y ago
      [deleted]
  - therealmarv 3y ago
    The second factor is not meant or designed to safe you against a compromised PC or phone (your session or cookies could be probably more easily stolen even when second factor on another device). Many people have passwords and totp on the same phone too. The second factor is more meant to verify that you are really you to a web site and safeguard your account on that web site.
mksybr 3y ago
Aegis & KeepassXC. KeepassXC could do it all alone and seperate TOTPs under a seperate database secured to a different password if you please.
toomuchtodo 3y ago
I use Bitwarden, but have moved as many 2FA/MFA accounts to Passkeys as possible to avoid needing MFA.
gregmac 3y ago
> I also use bitwarden, but not sure how I feel about passwords and totp being in the same app. I guess this depends on your threat model. In what cases would your password vault be compromised, but your TOTP vault still be secure? If someone gets access to your unlocked PC/phone, don't they then have access to both? Do you store your TOTP vault password in your password vault (obvious)? If someone gets into your password vault, why wouldn't the same mechanism also let them get into your TOTP vault? (This applies whether it's brute force, keylogger, hardware exploit, or $5 wrench.)
- fauigerzigerk 3y ago
  >In what cases would your password vault be compromised, but your TOTP vault still be secure? If the password vault is on one device and the TOTP app on another then it would be harder for an attacker to get into both. I have the same concerns about passkeys. How is it secure if the only thing an attacker needs is a single method of accessing a single device?
  - lamontcg 3y ago
    Generally the threat model that TOTP protects against is not someone breaking into your device. The threat model that it protects against is someone compromising your other credentials. So, although not recommended, you could post your login credentials on twitter and still nobody would be able to get into your account. An attacker hacking into your laptop/desktop/phone with access to install keyloggers and hijack connections is not really what it protects against.
    - fauigerzigerk 3y ago
      >Generally the threat model that TOTP protects against is not someone breaking into your device. And yet, in some realistic scenarios TOTP does protect me against that, if the second factor is on a different device, kind of like a poor man's yubikey.
      - lamontcg 3y ago
thesuitonym 3y ago
It does feel bad, but your password manager is already protected by MFA, right? It does mean you're putting a lot of trust in your password manager, but on the other had, you already kind of were, weren't you?
ivandenysov 3y ago
I use Raivo for TOTP on iOS. It is open source and makes it easy to migrate to another app
- latchkey 3y ago
  I used to use it, but the author refuses to publish a desktop app. I actually was able to install the iOS app on my desktop, but if I ever remove it, it is gone forever because he revoked it from the appstore. He only wants you to use the desktop receiver. It is also buggy af and doesn't sync properly. He's pretty much not doing any more updates of the app either. That experience pushed me off it forever. Edit: The app has been acquired by a third party. I'd move off it. https://www.reddit.com/r/privacy/comments/158ihxd/raivo_authenticator_has_been_acquired_by_mobime/ https://www.reddit.com/r/privacy/comments/158ihxd/raivo_auth...
kangabru 3y ago
I had the same problem and didn't want to keep all of my eggs in the same basket, plus I lost faith in these backup apps after Google Auth lost user codes at some point. I decided to create a private backup which I control and so I built a client-side web app that encrypts QR codes (like 2FA codes). It was inspired by a similar CLI based project I saw here on HN. I still use Authy (for now) but now I have encrypted images that I can decrypt and rescan easily. And since they're just images I saved them in various places and even printed out copies should I lose my phone or Authy access. To 'migrate' my codes out of Authy I just went through each site and regenerated the codes (plus encrypted them). It's annoying that they force you to do this but doesn't take too long. I'm still polishing it up but it works well and I would love some feedback if there's anyone who finds it useful - https://encrypt-qr-codes.netlify.app/ https://encrypt-qr-codes.netlify.app/

I use Authy. I've read a few comments about how migrating away is difficult. What do you use instead? I also use bitwarden, but not sure how I feel about passwords and totp being in the same app.

drpossum 3y ago

I've moved over to Proton Pass (you can do TOTP on the desktop through a browser, I figured if I'm authenticating into a site I must have internet) but KeepassXC was a strong contender. Both have excellent mobile support and Keepass has native desktop clients. Proton Pass isn't free, though, but I already had their services.

protonmail 3y ago
Happy to hear you've switched to our password manager! Just to clarify, you can use Proton Pass for free too: https://proton.me/pass/free https://proton.me/pass/free.

latchkey 3y ago

> not sure how I feel about passwords and totp being in the same app I felt the same way and I've come to realize that it is not a big deal. One advantage is that with a shared password manager account, you can also share the TOTP along with it. Very convenient for a bunch of usecases.

gukov 3y ago
Is it really multifactor then, with everything in Bitwarden?
- latchkey 3y ago
  The way I see it, your password manager becomes the central point of failure. Therefore, secure your password manager with a hardware security key (yubi). Not all accounts stored in a password manager are created equal... some need more security than others. If there are accounts that you want additional 2FA security on, just use a separate TOTP app. It doesn't have to be an all or none option.
  - deleted 3y ago
    [deleted]
- therealmarv 3y ago
  The second factor is not meant or designed to safe you against a compromised PC or phone (your session or cookies could be probably more easily stolen even when second factor on another device). Many people have passwords and totp on the same phone too. The second factor is more meant to verify that you are really you to a web site and safeguard your account on that web site.

mksybr 3y ago

Aegis & KeepassXC. KeepassXC could do it all alone and seperate TOTPs under a seperate database secured to a different password if you please.

toomuchtodo 3y ago

I use Bitwarden, but have moved as many 2FA/MFA accounts to Passkeys as possible to avoid needing MFA.

gregmac 3y ago

> I also use bitwarden, but not sure how I feel about passwords and totp being in the same app. I guess this depends on your threat model. In what cases would your password vault be compromised, but your TOTP vault still be secure? If someone gets access to your unlocked PC/phone, don't they then have access to both? Do you store your TOTP vault password in your password vault (obvious)? If someone gets into your password vault, why wouldn't the same mechanism also let them get into your TOTP vault? (This applies whether it's brute force, keylogger, hardware exploit, or $5 wrench.)

fauigerzigerk 3y ago
>In what cases would your password vault be compromised, but your TOTP vault still be secure? If the password vault is on one device and the TOTP app on another then it would be harder for an attacker to get into both. I have the same concerns about passkeys. How is it secure if the only thing an attacker needs is a single method of accessing a single device?
- lamontcg 3y ago
  Generally the threat model that TOTP protects against is not someone breaking into your device. The threat model that it protects against is someone compromising your other credentials. So, although not recommended, you could post your login credentials on twitter and still nobody would be able to get into your account. An attacker hacking into your laptop/desktop/phone with access to install keyloggers and hijack connections is not really what it protects against.
  - fauigerzigerk 3y ago
    >Generally the threat model that TOTP protects against is not someone breaking into your device. And yet, in some realistic scenarios TOTP does protect me against that, if the second factor is on a different device, kind of like a poor man's yubikey.
    - lamontcg 3y ago

thesuitonym 3y ago

It does feel bad, but your password manager is already protected by MFA, right? It does mean you're putting a lot of trust in your password manager, but on the other had, you already kind of were, weren't you?

ivandenysov 3y ago

I use Raivo for TOTP on iOS. It is open source and makes it easy to migrate to another app

latchkey 3y ago
I used to use it, but the author refuses to publish a desktop app. I actually was able to install the iOS app on my desktop, but if I ever remove it, it is gone forever because he revoked it from the appstore. He only wants you to use the desktop receiver. It is also buggy af and doesn't sync properly. He's pretty much not doing any more updates of the app either. That experience pushed me off it forever. Edit: The app has been acquired by a third party. I'd move off it. https://www.reddit.com/r/privacy/comments/158ihxd/raivo_authenticator_has_been_acquired_by_mobime/ https://www.reddit.com/r/privacy/comments/158ihxd/raivo_auth...

kangabru 3y ago

I had the same problem and didn't want to keep all of my eggs in the same basket, plus I lost faith in these backup apps after Google Auth lost user codes at some point. I decided to create a private backup which I control and so I built a client-side web app that encrypts QR codes (like 2FA codes). It was inspired by a similar CLI based project I saw here on HN. I still use Authy (for now) but now I have encrypted images that I can decrypt and rescan easily. And since they're just images I saved them in various places and even printed out copies should I lose my phone or Authy access. To 'migrate' my codes out of Authy I just went through each site and regenerated the codes (plus encrypted them). It's annoying that they force you to do this but doesn't take too long. I'm still polishing it up but it works well and I would love some feedback if there's anyone who finds it useful - https://encrypt-qr-codes.netlify.app/ https://encrypt-qr-codes.netlify.app/