Authentication apps

[Old Thrashbarg]

I also have another piece of advice that's probably more helpful than the above: migrate away from Google Authenticator onto Authy, it works across devices.

Interesting. Not heard of Authy before. How does it synchronise? Presumably an account needed for tokens to be stored remotely or something along those lines?

I've always just used Google Authenticator because it was the first I tried, did the job well and it's never given me a reason to look for anything else.

[Sebastian Cobb]

It works a bit like a password manager so the app puts your token seeds (the codes or qr code you initially scan) in a vault, encrypted with a master password you input to decrypt on other devices.

It generates the same codes Google Authenticator would and I think it can work with other token schemes too.

Google Authenticator is fine if you only want things on one device, but I like the portability.

There's a slight security trade off, as if someone got into your laptop they might be able to use a saved password and the code but I don't think that's the main thing 2fa is meant to guard against (I think it's to stop a stolen password being used without going near your devices). And at that point they'd already have access to a lot of logged in sessions anyway, I rely on passwords and device encryption to keep people out.

[Old Thrashbarg]

And how does the vault get stored and accessed? Same sort of thing as a password manager again, with it just being a file you store locally?

Like you, not too bothered about the security aspect once the device itself has been compromised. But I think I'd find it useful/convenient to be able to generate codes from the device I mostly use them on (my laptop), rather than having to reach for my phone.

[Sebastian Cobb]

The vault is on their servers, but you need to supply the master password to decrypt it when you login on a new device.

I have it installed on my work laptop and my phone. I do have 2fa on some personal things but don't need to supply them frequently enough that I've been arsed to install it on my home laptop, but good to know I can if I lost or broke my phone.

[Old Thrashbarg]

Ah, it was online storage of the vault I wanted to avoid. Not sure that would pass muster with the security audits we're required to have.

[steveh]

Google Authenticator will now let you synchronise services across devices if you enable it. However, unlike Authy (and some others?) it doesn't use end-to-end encryption or a master password despite lots of security people pointing out the danger in this. This was an issue in a recent security breach.

https://arstechnica.com/security/2023/09/how-google-authenticator-gave-attackers-one-companys-keys-to-the-kingdom/