I currently use Authy on my android and my Linux system.
It syncs every new authenticator between my devices but I dont want to trust companies with my security anymore.
I host a nextcloud instance on my homelab. Does anyone know a good FOSS authenticator that can use my nextcloud to sync between Linux and android? Provided that it is available on both of course.
Thanks for any input!
ikornaselur ( @ikornaselur@lemm.ee ) 26•10 months agoHave you checked out Aegis?
Edit: I missed the Linux requirement, not sure if Aegis works with that in mind
Appears to be android only?
lemmyvore ( @lemmyvore@feddit.nl ) English6•10 months agoYou can use OTPClient on desktop, it can import Aegis encrypted exports.
It’s what I do, my TOTP codes originate on the phone because I scan the QR codes with it, but Aegis is set to export a backup each time something changes.
A sync app (FolderSync) runs every night and gets the export to my server, where it gets picked up for offline backups.
I load the latest export in OTPClient only as needed, when I run into a 2fa which is not there.
Both Aegis and OTPClient can be set to ask for password each time you open them.
i guess that’s what i’ll do :-) sounds good!
Dessalines ( @dessalines@lemmy.ml ) 23•10 months agoKeepass supports OTP, and exists on every platform. I use KeepassDX on android.
Cargon ( @Cargon@lemmy.ml ) 11•10 months agoThis is what I used as well (KeePassXC specifically), with Syncthing sharing the .kdbx file across devices.
Ben ( @bipolarben@beehaw.org ) English2•10 months agoThis is the way.
daco ( @daco@lemm.ee ) 4•10 months agoI’m using this with Nextcloud through WebDAV.
There is a keepass app in Nextcloud to access your keepass database using a web browser (keeweb), keepassXC has a client for Linux, Mac and windows (and all of them work great) and there are many apps for iOS and android.
I use the free version of Strongbox with WebDAV and I haven’t had any problems.
You can just backup the keepass database file and you can also have several databases. Each database has its own password.
detalferous ( @detalferous@lemm.ee ) 18•10 months agoAegis
Nils ( @nils@feddit.de ) 6•10 months agoI personally use Bitwarden for my 2FA needs. As others mentioned you can self host the server but personally I have no reason not to trust their SaaS solution, especially now that they offer EU hosted servers. If all you want is a basic authenticator app that does only one thing give FreeOTP a try, it’s made my RedHat. You can then sync the applications state.
Cralder ( @Cralder@feddit.nu ) 4•10 months agoI use bitwarden for 2FA as well. The only issue I have is that I need another solution as well since I also have 2FA activated on my bitwarden account. You can’t have bitwarden 2FA saved on bitwarden. (Well you can but that’s obviously a bad Idea)
Nils ( @nils@feddit.de ) 1•10 months agoThat is true. But that’d be the case for any online/cloud 2FA service. So you could either have a local 2FA app just for Bitwarden or set up less secure but more convenient email 2FA.
cooopsspace ( @cooopsspace@infosec.pub ) English6•10 months agoAegis synced with my Nextcloud server.
👁️👄👁️ ( @mojo@lemm.ee ) English5•10 months agoI just bitwarden pass manager to store all my 2fa stuff. I just let the company host my account, but if you don’t want that then you can self host your own bitwarden server for free. It’s very convenient, especially with the autofill on desktop and mobile.
kambusha ( @kambusha@feddit.ch ) 2•10 months agoLast time I checked Bitwarden, it didn’t have a way of recognising when password is changed for an existing account (to prompt you to update saved pw); is that still the case?
Also, would you happen to know if Bitwarden allows you to setup another user to have emergency access? As in, they could request access to your account and if you don’t deny within X days, they get access? (Digital will type of deal)
👁️👄👁️ ( @mojo@lemm.ee ) English2•10 months agoThe first part, yes it does. Though I never use it and manually edit it. The second part, no idea tbh.
napkin101 ( @napkin101@infosec.pub ) 3•10 months agohttps://bitwarden.com/help/emergency-access/ It alows for the second part too.
kambusha ( @kambusha@feddit.ch ) 1•10 months agoJust saw this after I posted my other comment… thanks!
kambusha ( @kambusha@feddit.ch ) 2•10 months agoThanks! It looks like they do have emergency access too: https://bitwarden.com/help/emergency-access/
Might look into switching over to them again.
valkyrie ( @valkyrie@lemmy.ml ) 1•10 months agoWhat do you use for your 2fa for Bitwarden itself?
👁️👄👁️ ( @mojo@lemm.ee ) English1•10 months agoEmail, sms, mfa from another bitwarden logged in, and my yubikey
Dsklnsadog ( @Dsklnsadog@lemmy.dbzer0.com ) 4•10 months agoI’m surprised no one has recommended “2FAS” yet. It’s the open-source alternative. The app is primarily designed for mobile, but they also offer a browser extension that you could install on Linux if you wanted to. Personally, I always try to keep my 2FA apps unsynchronized with a desktop PC.
Oh, and you can export your secrets at any time. Not like Authy.
nyakojiru ( @nyakojiru@lemmy.dbzer0.com ) 3•10 months agoBitwarden
Extras ( @Extrasvhx9he@lemmy.today ) 3•10 months agoMake a kdbx vault just for your totp seeds that way you only need an editor, like keepassdx for android or keepassium for ios, and keepassxc for desktop
Justin ( @jlh@lemmy.jlh.name ) 3•10 months agoFreeOTP+, it was written by Red Hat and is now maintained as a open source project.
kraxyk ( @kraxyk@beehaw.org ) 3•10 months agoPersonally I would use andOTP on my mobile with backups and use OTPClient on my computer. I don’t like having my 2 factor auth stored in the same system as my passwords. Because if the password manager was ever lost or stolen you’d have all your eggs in one basket essentially.
n2burns ( @n2burns@lemmy.ca ) 3•10 months agoCopied from my other comment in this thread:
andOTP is no longer maintained, so it’s not a good suggestion and you should probably see about migrating to another app. I personally went to Aegis and had a smooth transition.
kraxyk ( @kraxyk@beehaw.org ) 1•10 months agoWhile that is true, there have been many discussions about if there are any known security vulnerabilities or new spec changes that would cause a problem. The consensus from the community is that it is safe to use for quite some time. Not invalidating your points in any way just putting out what I know.
neeeeDanke ( @neeeeDanke@feddit.de ) 2•10 months agoKeepassXC supports 2fa natively and in Keepass2 there is an addon available. I have a .kdbx I sync with nextcloud to my pcs and access it via WebDav on Keepass2Android. It works great (when nextcloud sync works, recently had an issue with "invalid modification date"s on my pc).
Envis10n ( @envis10n@lemm.ee ) 1•10 months agoandOTP is a good option for Android. It does offer backup capabilities which could be used for syncing. Bitwarden is also good
n2burns ( @n2burns@lemmy.ca ) 8•10 months agoandOTP is no longer maintained, so it’s not a good suggestion and you should probably see about migrating to another app. I personally went to Aegis and had a smooth transition.
narwhal ( @narwhal@lemmy.ml ) 4•10 months agoI moved from andOTP to Aegis. Can say that’s it’s been solid so far 👍
Carlos Solís ( @csolisr@communities.azkware.net ) 1•10 months agoI store my OTPs in a self-hosted Vaultwarden (a Rust reimplementation of Bitwarden) and also on Aegis in case I ever need to be offline for long.
narwhal ( @narwhal@lemmy.ml ) 3•10 months agoI purposefully split my passwords and OTP. Don’t want them to be in one app/place. Kinda defeats the purpose otherwise IMO.
Envis10n ( @envis10n@lemm.ee ) 2•10 months agoOh thanks