FOSS Desktop 2FA app?
FOSS Desktop 2FA app?
I'm trying to move away from Authy since they're ending support for their desktop app, and I thought Aegis would be the right app for me to jump to, but it doesn't seem to have a desktop app. So I'm wondering what FOSS apps the rest of you use for Desktop and Mobile 2FA?
I use KeepPassXC for desktop totp codes. I’m sure there’s an Android app to use with it. (I use KeePassium on iOS). Edit: maybe look into KeePass2Android
You can sync with Syncthing for offline. I keep the database in the cloud but with a key on each device (not in the cloud) that’s needed to open it.
The best Android KeePass client I've used is by far KeePassDX
KeepassDX on Android and KeepassXC on Desktop, sync with SyncThing, done! AndOTP on Android is nice, but it won't run on Desktop.
I'm in the same boat. And I came across 2FAS (Android) (Website).
It doesn't have a dedicated desktop app, but it does have a browser extension, which I think is the best we're going to get.
I spent a fair amount of time looking around for an alternative when Authy announced they're killing their desktop app. 2FAS is the best I found.
If anyone else has a good suggestion, I'm all ears.
My requirements:
- Android App
- Desktop App (Linux only)
- Synchronization between the two
- (not a hard requirement) FOSS, or at least just Open Source
I'd be willing to pay for a decent solution.
I didn't realize it at the time, but Authy locks you in with no way to export your tokens. There are unofficial scripts on GitHub, but I haven't tried them yet.
Edit: specified Linux desktop. I don't use Windows.
Does Bitwarden count?
Slightly off topic but desktop 2FA apps kind of kill the point of 2FA.
2FA protects you by ensuring that even if your computer is compromised your account will have a layer of protection in that second factor “aka something you have”.
If you have that on your desktop, you might as well not have it.
If you find 2FA off of your desktop annoying I recommend looking into passkeys. Open standard and less annoying. Just not well supported.
Passkey is on your device though?
It doesn’t kill the point of 2fa. It’s something you have… you have your device. If you didn’t you wouldn’t have the TOTP code.
The something you know (password) is much more likely to be breached and stolen. That is what isn’t tied to your device. You probably want the second factor to be linked to just the devices you have.
I've seen people say this, but what makes your phone so much safer than your computer?
It’s the second factor that adds security. Aka “something you have”.
If you use totp on your phone to log into an app on your phone yah it’s true it’s not much more secure (although I would argue app isolation does make it more secure) but using your phone to provide totp for your desktop proves that second factor.
That makes absolutely no sense.
If your mobile device is compromised they'll have access to it there also.
Modern smart phones were architected from the beginning to have app isolation. That makes the difference.
Your phone runs by default like a Linux system with selinux in mls mode with 100% coverage mls isolation policies baked in. That’s just a more secure foundation to build on. No Linux distro today has selinux in mls mode with 100% binary coverage with isolation policies.
Using your phone is a good safe compromise. Unless you are running Qubes OS you aren’t going to beat it.
Where do you keep your TOTP if not on your devices? Or do you own a separate device exclusively for TOTP?
For less important things I keep my TOTP credentials on my phone. Not perfect but definitely safer than a PC statistically speaking.
For more important things I use either a passkey or yubikey or a gpgsmart card depending on what is supported. All three work via usb or NFC.
You can try GNOME's Authenticator, it's pretty simple but it gets the job done