AppBITS: Proton Authenticator Takes on 2FA Apps

Article Comments
41

5 posts were split to a new topic: Passkeys replacing the need for 2FA

42

I do like Duo Mobile. It’s owned by Cisco when they bought up the security startup. It let’s you sign up and use it for personal use without having to pay until you need more licenses and let’s say you are a small to medium business.

Google and Duo now migrate the stored entries when you upgrade your phone in-place.

43

I have a dumb question. I use Google Authenticator with some sites. I can’t just switch to Proton Authenticator though, can I? I mean, the fact I use Google Authenticator is because the sites said to use it. How can a new authenticator easily get adopted?

44

Not a dumb question. Yes, you can switch to another of these Authenticator apps, since they all use the same protocol as Google Authenticator does. The Apple Passwords app can also be used to generate codes, as can 1Password and BitWarden and other password managers. That said - if Google Authenticator is working well for you, there’s really no reason to switch.

1 Like
45

That’s interesting. And weird. I always thought these codes were more unique than that. It somehow makes it feel “too open.”

One of my banks sends me a dedicated device that generates a code and needs to be replaced every few years. Does that also use the same protocol?

46

You can’t just use the new authenticator, you will have to reseed the number with your new app. At least that’s what I assume since the seed number is generated by the program the first time you sync. Though you can use any authentication app or program, you can’t switch between different apps without the reseed. That would be my understanding

47

As previously detailed, you can import codes from Google Authenticator into Proton Authenticator. Also, some other Authenticator apps show you the secret or even a QR code so if you have another device you can use it to scan the QR code (or you can manually enter the secret.)

1 Like
48

Actually, the codes generated by Google Authenticator and other apps based on the same 2FA standard aren’t “weird” or more “open” than older standards. Users can resynchronize the code generator whenever they want; physical code fobs cannot be reset by users. The current standard hasn’t been compromised unlike the RSA standard used by many physical fobs. Finally, openness can be an advantage for security. Protocols and algorithms that depend on secretive code bases cannot receive the same levels of scrutiny and testing that widely adopted open source or publicly visible code does.

Which protocol your physical fob uses depends on its manufacturer.

49

If your old app has a way to export those seeds, you can import them into another app.

For example, Google Authenticator can export them to a proprietary QR code (up to 10 codes per QR) that can be read by other instances of Google Authenticator (so there’s no need to sync via your Google cloud storage).

Fortunately, the proprietary “otpauth-migrate” URN schema isn’t too proprietary. There are open source projects that will decode it into a set of standard otpauth URNs, which you can use for migration to other apps (or for re-creation of the original QR codes, which anything can scan).

See also:

Of course, this is just Google Authenticator. Other apps may export the keys in other ways. And it will always be easier if your new authenticator app can just import directly from your old one.

50

They are more unique than that. The secret for each is only on your device. You can do what you want with it, delete it or migrate it to another app. I would says it’s “interoperable”

1 Like
51

You should take a look at Ravio OTP, https://raivo-otp.com, which provides iOS and MacOS apps for 2FA and backup in iCloud. Open source on GitHub.

52

Because of work, I use Microsoft Authenticator. Good enough for me.

53

Unfortunately I did not do sufficient due diligence before I decided to use Authy early this year. Then I found out that development of its Mac desktop app was dropped because Authy had been hacked, making exporting data to a different app impossible without access to a Windows computer.

Then I learned that Authy collects personal data that is linked to a unique user ID number. Then it monitors a variety of non-anonymous data analytics such as the online services used which are regularly uploaded to Authy servers. I can think of no reason why this potentially sensitive information should be collected by an authenticator app.

Fortunately I stumbled upon open-source Ente Auth and since I had fewer than 15 accounts, manually transferring them took less than an hour to accomplish.

Ente Auth has a MacOS app that can be locked using the device (Face ID, Touch ID, system password), a 4-digit pin or password. My favorite feature is that when the app is unlocked, it is quickly accessible via an icon in the Finder menu Bar. I am always on my personal computer when I need 2FA so I find this option much more convenient than using my iPhone.

I opted to create an account after carefully looking at Ente’s end-to-end encryption protocols and listening to an in-depth interview with its founder about his motivations behind developing an free and secure authentication app.

I was a 1Password user for many years. But then I suffered through the worst commercial software tech support experience in 30+ years of using Macs after I was locked-out of my data after upgrading to a subscription account. (The issue was on their end.) Fortunately, I had a current local .csv file backup. Suffice it to say that I couldn’t see trusting my data to their “care” going forward.

1 Like
54

As a 100% apple user, I don’t see why I need anything other than built-in Apple Passwords. What am I missing?

55

The point of these apps are that they are cross platform, so they’re for people who need to sync passwords/auth across platforms. If you’re Apple only, Passwords is fine.

1 Like
56

Also, since Apple Passwords uses iCloud, anybody who wishes to not have their 2FA tied to cloud servers can choose an app that keeps everything on-device only. Another reason can be people who use compartmentalization as part of their security and privacy strategy.

2 Likes
57

Ente Auth also has a self-hosting option for those who prefer to manage their own server.

58

Perhaps the one big risk, and it’s likely a very small risk for anyone, is Apple canceling your iCloud / Apple ID for some reason.

1 Like
59

I’ve been using 2FA for over a decade and Passwords app is very recent. If I was starting today I’d probably use Passwords but as it is I find little reason to migrate. I might try having both running alongside each prefer at some point—a project for a rainy day.

60

This is one of those things that is deceptive. I’m sure from a technical standpoint it would be relatively easy to add an app-specific PIN for access. But from a human standpoint it makes things a lot more tricky as you then need a PIN recovery process. This in turn can be the weak link in the security chain or a significant support cost, or both!

1 Like