Nevertheless I chose my Yubikey instead.

  • noodlejetski@lemm.ee
    link
    fedilink
    English
    arrow-up
    57
    ·
    7 months ago

    that’s a refreshing change from the regular Google Authenticator and Authy mentions.

  • QuazarOmega@lemy.lol
    link
    fedilink
    English
    arrow-up
    22
    ·
    edit-2
    7 months ago

    Incredibly based.
    Come to think of it, it’s sad how we’ve got so accustomed to be suggested Google Authenticator and the other big corp data funnel 2FA apps by the services that support it

  • hswolf@lemmy.world
    link
    fedilink
    English
    arrow-up
    20
    ·
    7 months ago

    If you get Bitwarden pro (really cheap), you can save an OTP link together with the site credentials, it’s really good for keeping everything in one place

      • kniescherz@feddit.de
        link
        fedilink
        English
        arrow-up
        14
        ·
        7 months ago

        I would argue its more like a 1.5 factor. Not secure when your bitwarden gets compromised. But more security for stolen, leaked, phised passwords.

        I currently have 60 OTPs in Bitwarden, I probably would not have activated 2FA on so many sites without BW.

      • hswolf@lemmy.world
        link
        fedilink
        English
        arrow-up
        2
        ·
        7 months ago

        yeah, while I understand that, it’s not every time I have both my phone and computer together at the same time

        using a standalone OTP on either one of them would make the opposite a pain in the ass to use

        I take a lot of precautions with my main vault password, even got a biometric reader so I don’t have to type the password that much

        • PracticalParrot@discuss.tchncs.de
          link
          fedilink
          English
          arrow-up
          2
          ·
          7 months ago

          You’re absolutely right. It’s all about your threat model, how much convenience you’re willing to lose and what not.
          I absolutely should do more to minimize potential risk, but it’s really so convenient to just… Have it all in 1 place…

    • derpgon@programming.dev
      link
      fedilink
      English
      arrow-up
      4
      ·
      7 months ago

      If you get Vaultwarden, absolutely free, you don’t have to pay and have full control over your data. It’s a win-win!

    • Star@sopuli.xyz
      link
      fedilink
      English
      arrow-up
      2
      ·
      7 months ago

      They don’t, though? Who’s forcing you to install a proprietary 2FA app in India. Unless you’re saying in general.

      • nutbutter@discuss.tchncs.de
        link
        fedilink
        English
        arrow-up
        2
        ·
        7 months ago

        My bank, for example, does not let us use any 2FA app we want. They have their own separate app, made for handling 2FA for that specific bank only.

        And in general too, yes. Like Arogya Setu. The app we had to install to prove our vaccination status.

        • OfficerBribe@lemm.ee
          link
          fedilink
          English
          arrow-up
          3
          ·
          7 months ago

          As per their FAQ:

          Permission to access your location

          Q: I got a prompt asking me to grant permission for the app to access my location. Why am I seeing this?

          A: You will see a prompt from the Authenticator app asking for access to your location if your IT admin has created a policy requiring you to share your GPS location before you are allowed to access specific resources. You’ll need to share your location once every hour to ensure you are still within a country where you are allowed to access the resource.

          • Aniki 🌱🌿@lemm.ee
            link
            fedilink
            English
            arrow-up
            2
            ·
            edit-2
            7 months ago

            And? I don’t give a shit what the admins of my network want. It’s DFA – they don’t deserve to know that. Ergo, I don’t use the MS app. They can kiss my ass and fire me if they don’t trust where I am.

            • OfficerBribe@lemm.ee
              link
              fedilink
              English
              arrow-up
              2
              ·
              7 months ago

              It’s a security / compliance policy. There is a very high chance your company has not even enabled it, have not seen anyone using it.

              As I see it, you would and could use it only if you force MS Authenticator notification as the only MFA method and it is important in which country MFA prompt originates. Usually it is IP based block / whitelist which checks IP from which login originates which seems like a much more useful info, then you can also allow any MFA method.

              You can always deny permissions to apps.

                • OfficerBribe@lemm.ee
                  link
                  fedilink
                  English
                  arrow-up
                  2
                  ·
                  7 months ago

                  Your question was why GPS permission is needed, you should now know why.

                  I am using MS Authenticator and Aegis. Using MS authenticator only for work accounts that have been setup for number matching feature, it is pretty nice to simply enter 2 digits in app than entering 6 digits in client itself any time you need to approve MFA.

                  Everything else that supports standard TOTP whether work related or personal is on Aegis - it is a much better TOTP app.

      • ReversalHatchery@beehaw.org
        link
        fedilink
        English
        arrow-up
        2
        ·
        7 months ago

        That depends. More of the popular ones don’t encrypt the secret keys, they can just be read out with root access or even with the use of ADB (the pull command), not even speaking about reading the memory contents while booted to a recovery.
        Some even uploads the keys to a cloud service for convenience, and they consider it a feature.

        • OfficerBribe@lemm.ee
          link
          fedilink
          English
          arrow-up
          1
          ·
          7 months ago

          Sounds more like a bad design than purposefully left backdoors. Very few devices are rooted and usually you cannot get root without fully wiping your device in process. As for cloud upload, that indeed is convenient for most regular users. I prefer encrypted offline backup like Aegis does, but you need to think about regular folk if they would loose or wipe their device.

          • ReversalHatchery@beehaw.org
            link
            fedilink
            English
            arrow-up
            1
            ·
            7 months ago

            It’s not bad design, it’s definitely intentional, however I agree that it’s probably not for having backdoors, but for convenience. Average people forget their passwords all the time, and with encryption that level of carelessness is fatal to your data if they have not saved it somewhere, which they probably didn’t do.

            Very few devices are rooted and usually you cannot get root without fully wiping your device in process.

            I’m pretty sure the system is not flawless. Probably it’s harder to find an exploit in the OS than it was years ago, but I would be surprised if it would be really rare. Also, I think a considerable amount of people use the cheapest phones of no name brands (even if not in your country), or even just tablets that haven’t received updates for years and are slow but “good for use at home”. I have one at home that I rarely use. Bootloader cannot be unlocked, but there’s a couple of exploits available for one off commands and such.

    • Truck_kun@beehaw.org
      link
      fedilink
      English
      arrow-up
      1
      ·
      edit-2
      7 months ago

      I’d love to know as well.

      Been using it for a while as the 2FA app used and recommended by Leo Laporte. I’ve had a good experience with it, but if it has any issues, I would love to know.

      Edit: A while being a year or two.

      • BolexForSoup@kbin.social
        link
        fedilink
        arrow-up
        11
        ·
        edit-2
        7 months ago

        Setting restrictions on what 2FA/authenticators we can use. I imagine it’s only a matter of time before Google functionally makes it so you can only use theirs when using their services.

        Edit: I assumed it was some of the messages I’ve seen elsewhere, my mistake. I don’t need everybody repeating the same comment. Please read the responses before telling me the exact same thing over and over again guys lol

        • Instantnudeln@feddit.de
          link
          fedilink
          English
          arrow-up
          17
          ·
          7 months ago

          They recommend these two. Under the recommendations it even says you can also use different apps…

        • Y2K38@lemmy.oneOP
          link
          fedilink
          English
          arrow-up
          17
          ·
          7 months ago

          At least for what I just posted this isn’t a restriction. Its a recommendation. You can still use any other app. I thought its nice that they recommend the privacy friendly ones.

        • starlord@lemm.ee
          link
          fedilink
          English
          arrow-up
          3
          ·
          7 months ago

          I’ve gone tons of places that say use Google Authenticator (only) and I just summon the QR code and scan with Aegis anyway and it always works fine. I’ve never seen a place that required a certain one.