One more step to unhitching from Google…
Right now the only option I see in F-Droid is Aegis.
I’m not sure what to actually look for side from checking for unexpected permissions and reasonably frequent updates.
Hopefully something I can sync with a GNOME app…
I use Aegis, it works well
I like Aegis.
Bitwarden. I don’t self host it, though. $10 a year for password management and 2FA is fine by me.
Same. Self hosting it sounds nice, and I self host a handful of services, but I don’t want to be stuck without passwords in another country with a dead server at home because a power cut happened at some point.
Bitwarden caches your vault to your device, so you don’t actually need a live connection to the server.
I had fault in my server this summer and my local bitwarden app wouldn’t work without the connection. Same in my laptop, if the connection is blocked by the firewall it doesn’t let me load the vault at all.
bitwarden works fine for me without connection, you just cant update/create passwords
Oh, that’s actually good to know. I guess it makes sense for when you don’t have a good connection as well.
It’s niche but I like to point it out whenever I get the opportunity: if your workplace uses Bitwarden Enterprise, every licensed user gets a free family plan that can be linked to any account. I haven’t personally paid for BW for years.
As I’ve seen gaming server subscriptions go from £36/y to £23/m (Xbox) in a few years, and cloud CCTV storage from £40/y to £16/m (Google via acquisition of Nest) in a few months, I say we count our stars when a subscription cost remains fair.
I’m on the same plan, I do plan to self host it though as a backup only.
I’ve been using KeePassXC. I use Syncthing to keep the database synchronized between computers.
Same here. If it’s TOTP based 2fa, you can keep them in entries and use them from there.
Yes, the only issue I have with it is that you can only have one TOTP for each site entry (need to create two separate entries if using two accounts).
I use Aegis on my phone.
Aegis.
I like the auto backup feature (encrypted) . Then the backup is synced to computer via Syncthing.
Set and forget setup.
For me aegis is by far the best. Simple. Encrypted. Backup. It’s saved to a syncthing folder. Passwords are in bitwarden for simpme stuff but keepassxc is great. And also synced via syncthing.
I also use aegis. Have been for years and it works great
Aegis
Aegis ♥️
“Unmodified 20? Yeah, you just know your 2FA without even checking somehow”
Bitwarden
I’m a little concerned about having OTP and passwords together in one system.
OTP is on my phone, Bitwarden is on my computer. I don’t use the OTP in Bitwarden.
This is the way. I use Bitwarden and Aegis.
The issue here is putting Bitwarden on your phone with OTP in Bitwarden.
On the phone, I use Authy, More eggs - more baskets.
Yah, I can’t see a point to have another app/extension when Bitwarden has it built in, and it’s a great password manager.
Wait, it does? Including in the mobile app? I don’t see it.
Right under Password in the edit screen of an item: Authenticator Key. You put in the auth key the target site provides you when you enable TOTP and it will start generating timed tokens. Usually you’ll also get a one-time pad of backup keys, I usually toss those in the Notes of the edit screen there as well in case something goes wrong.
The browser extension also lets you scan the page for QR codes for the TOTP key.
The point of 2FA is “something you have” and “something you know” to enter a secured system.
If you put both of those into one system that is accessible by one password, the whole concept is defeated.
My threat model isn’t having someone take my computer and log into stuff so my concern when using 2FA is more about them having gotten hold of a password remotely. But a TOTP makes that password pretty hard to use, no matter where it’s stored. And my BW is also protected by a Yubi/password combo, so I guess I’m just vulnerable to having that beaten out of me.
The other issue with this - If you lose access to that one system, you’re SOL. It’s a single point of failure.
That I could accept as a good reason.
But if they get your Bitwarden vault and crack it - they have everything Throw a roadblock in their way - use a separate app for OTP.
Bitwarden
I’ve been using Aegis for several years now without any problems. It replaced the Google Authenticator seamlessly.
Aegis
Bitwarden Authenticator because Bitwarden seems to have a good reputation. I don’t use their password manager, though.
It does seem faintly insecure that it displays all of the codes at once on one page, but I’m having trouble imagining a scenario where it’s actually a problem.Enteauth
2FAS Authentication
Been using it for a while. It’s pretty awesome.
