deddit.petersanchez.com

What are you all using for a 2FA token manager?
from BonkTheAnnoyed@lemmy.blahaj.zone to selfhosted@lemmy.world on 13 Oct 00:45
https://lemmy.blahaj.zone/post/33020376

One more step to unhitching from Google…

Right now the only option I see in F-Droid is Aegis.

I’m not sure what to actually look for side from checking for unexpected permissions and reasonably frequent updates.

Hopefully something I can sync with a GNOME app…

#selfhosted

threaded - newest

cmnybo@discuss.tchncs.de on 13 Oct 00:59 next collapse

I’ve been using KeePassXC. I use Syncthing to keep the database synchronized between computers.

synestine@sh.itjust.works on 13 Oct 01:23 next collapse

Same here. If it’s TOTP based 2fa, you can keep them in entries and use them from there.

30p87@feddit.org on 13 Oct 06:10 collapse

Tbh, if you’re using the same DB for PWs, you’ve successfully downgraded to 1FA now. Except maybe if you use a seperate KeyStick/Yubikey as secret bearer or smth

hikaru755@lemmy.world on 13 Oct 07:00 next collapse

More like 1.5FA, at least. It still protects against passwords being compromised in any way that doesn’t compromise full access to your password database, which is still a lot better than using just passwords without a second factor.

example@reddthat.com on 14 Oct 00:49 collapse

that’s like calling strong randomly generated passwords 1.5FA.

with proper MFA, even if you steal my password (database), you won’t be able to steal my account, as you’re missing the second factor. with classic otp this is just a single use number you enter on the potentially compromised system, but if you get the seed (secret) stolen, valid numbers can be generated continuously.

password managers (should) protect against reuse. MFA protects against logins on untrusted and potentially compromised systems/keyloggers if they’re not extracted live. password managers with auto fill and phishing resistant MFA can prevent phising, although the password manager variant is still easily bypassed when the user isn’t paying enough attention, as it’s not even that uncommon for login domains to change. obviously there are also other risks on compromised devices, like session cookie exfiltration, and there is a lot of bullshit info around from websites, especially the ones harvesting phone numbers while claiming to require it for 2FA just to gaslight users.

hikaru755@lemmy.world on 14 Oct 09:00 collapse

even if you steal my password (database)

That’s a big leap you’re doing there, equating stealing a password to stealing a password database. Those are very different. Stealing a password can be done through regular phishing, or a host of other methods that don’t require targeted effort. Stealing a password database, if properly set up, is a lot harder than that. It depends of course on what password manager you’re using, but it usually involves multiple factors itself. So equating that to just a password, no matter how strong and random, is just misleading.

Mind you, I agree that it’s less secure than “proper” MFA, and I’m not saying that everybody should just use MFA through a PW manager. I am using physical security keys myself. But for a lot of regular people that otherwise just couldn’t be bothered, it’s absolutely a viable alternative that makes them a whole lot safer for comparatively little effort. Telling them they just shouldn’t bother at all is just going to create more victims. There is no such thing as perfect security, and everyone has a different risk profile.

N0VERCLOCKER@discuss.tchncs.de on 13 Oct 12:57 collapse

I would say it still counts as 2fa just shifting what is verifying you to your password manager and using the site password and 2fa as a way to verify the password manager with the site. If setup right they would have to have the database and your password to decrypt it not just one or the other and for password managers that sync the database it should require your password and 2fa to sync to a new device so it can’t just be freely grabbed. If that doesn’t count as 2fa then I would like to see an argument about how okta signing you into sites counts as 2fa as it is basically the same thing.

pedroapero@lemmy.ml on 19 Oct 16:59 collapse

Yes, the only issue I have with it is that you can only have one TOTP for each site entry (need to create two separate entries if using two accounts).

pipe01@programming.dev on 13 Oct 01:15 next collapse

I use Aegis, it works well

AMillionMonkeys@lemmy.world on 13 Oct 01:46 next collapse

Bitwarden Authenticator because Bitwarden seems to have a good reputation. I don’t use their password manager, though.
It does seem faintly insecure that it displays all of the codes at once on one page, but I’m having trouble imagining a scenario where it’s actually a problem.

example@reddthat.com on 13 Oct 01:55 next collapse

FreeOTP/FreeOTP+

depending on your goal for this (real 2fa vs just simulated) you shouldn’t have sync in the first place.

you could also look into security keys (hardware solution, webauthn/FIDO2) as an alternative that has strong security with good user experience (no typing anymore), but they’re not as widely accepted.

solrize@lemmy.ml on 13 Oct 02:20 next collapse

I’m currently using FreeOTP from F-droid. Aegis seemed to have way too much extra crap. You don’t want to sync multiple 2fa applications together since the idea of the 2nd factor is it’s only in one place. Even being able to back it up is sort of contra, but if you have to, make sure the backup is well safeguarded.

The basic TOTP algorithm is quite easy to implement fwiw. A dozen or so lines of Python.

poccalyps@sh.itjust.works on 13 Oct 02:47 next collapse

2FAS Authentication

chillpanzee@lemmy.ml on 13 Oct 06:00 collapse

Been using it for a while. It’s pretty awesome.

salacious_coaster@infosec.pub on 13 Oct 02:49 next collapse

Bitwarden. I don’t self host it, though. $10 a year for password management and 2FA is fine by me.

HereIAm@lemmy.world on 13 Oct 08:33 next collapse

Same. Self hosting it sounds nice, and I self host a handful of services, but I don’t want to be stuck without passwords in another country with a dead server at home because a power cut happened at some point.

gaylord_fartmaster@lemmy.world on 13 Oct 11:07 collapse

Bitwarden caches your vault to your device, so you don’t actually need a live connection to the server.

HereIAm@lemmy.world on 13 Oct 11:12 next collapse

Oh, that’s actually good to know. I guess it makes sense for when you don’t have a good connection as well.

az04@lemmy.world on 13 Oct 13:28 collapse

I had fault in my server this summer and my local bitwarden app wouldn’t work without the connection. Same in my laptop, if the connection is blocked by the firewall it doesn’t let me load the vault at all.

EpicStuff@lemmy.ca on 14 Oct 12:57 collapse

bitwarden works fine for me without connection, you just cant update/create passwords

TedZanzibar@feddit.uk on 13 Oct 14:55 next collapse

It’s niche but I like to point it out whenever I get the opportunity: if your workplace uses Bitwarden Enterprise, every licensed user gets a free family plan that can be linked to any account. I haven’t personally paid for BW for years.

warmaster@lemmy.world on 13 Oct 22:38 next collapse

I’m on the same plan, I do plan to self host it though as a backup only.

Lyra_Lycan@lemmy.blahaj.zone on 13 Oct 08:46 collapse

As I’ve seen gaming server subscriptions go from £36/y to £23/m (Xbox) in a few years, and cloud CCTV storage from £40/y to £16/m (Google via acquisition of Nest) in a few months, I say we count our stars when a subscription cost remains fair.

Cyberflunk@lemmy.world on 13 Oct 02:58 next collapse

1password

BingBong@sh.itjust.works on 13 Oct 04:32 collapse

Definitely this, especially if you’ll be sharing with a non techie. My wife was able to pick 1password up and use it immediately and she normally turns her nose up at any of my recommendations.

For the 1password accounts 2FA, use a yubikey or aegis. Everything else to 1 password.

arox@lemmy.frozeninferno.xyz on 13 Oct 02:59 next collapse

What you mean syncing with Gnome app?

deathbird@mander.xyz on 13 Oct 03:24 next collapse

I like Aegis.

fubarx@lemmy.world on 13 Oct 03:26 next collapse

Doodleschmit@lemmy.world on 13 Oct 12:21 collapse

“Unmodified 20? Yeah, you just know your 2FA without even checking somehow”

gagootron@feddit.org on 13 Oct 04:04 next collapse

Yubikey. I dont want to trust my phone, so I use some separate hardware instead

ayyo@sh.itjust.works on 13 Oct 04:27 next collapse

I used aegis for a long time, switched to protons after they introduced it. Ideally I’d be using something physical though like a yubikey

nullpotential@lemmy.dbzer0.com on 13 Oct 04:55 next collapse

Enteauth

ceiphas@piefed.social on 13 Oct 05:34 next collapse

i use Mauth

IIRC it can sync by storing the Data in a file you can sync with a tool of your choice

ohshit604@sh.itjust.works on 13 Oct 06:08 next collapse

Yubikey for 2Fa codes also works well for sudo and su (2Fa) or if you still use Windows I think it supports single sign on there. Absolutely worth the purchase have had my keys for years.

mhzawadi@lemmy.horwood.cloud on 13 Oct 06:23 next collapse

We use yubikeys at work, far better then an OTP. Also I have 2 for home use, the only issue is I need to put 1 on some keys I carry as I sometimes need 1 and don’t have it.

5ymm3trY@discuss.tchncs.de on 13 Oct 06:39 next collapse

Can you explain a little more how you handle them in your daily life? I always liked the idea if Yubikeys, but I am a bit worried that I just would switch back to my phone (Aegis) for convenience. Things like:

Are there accounts that you didn’t get to work? Do you have separate keys for personal and work accounts? Do you just have it on your keychain an plug it in whenever you need it? Because always plugged in keys in your phone or laptop doesn’t really make sense. As far as I know you can’t just clone a key. How easy is it to setup a backup key? Does this work for all accounts? I try to not use my phone for critical stuff, but there are times I have to just check an account. Do you use your phone with Yubikeys? How is your experience? USB or NFC?

ohshit604@sh.itjust.works on 13 Oct 07:10 collapse

Can you explain a little more how you handle them in your daily life? I always liked the idea if Yubikeys, but I am a bit worried that I just would switch back to my phone (Aegis) for convenience.

I have two Yubikey 5 NFC’s, one I keep majority of my 2Fa auth codes on and keep on my keychain the other I leave at home mainly for backup 2Fa setups or desktop/WebAUTH/Single Sign-On logins, most websites won’t let you setup 2 2Fa keys so the second one mostly handles the plug-in and touch key portion of my setup.

Are they inconvenient? Yes, the amount of times where I got annoyed because I’ve had to grab my keychain to sign in has gotten annoying but not enough to switch back to online providers. I prioritized security over convenience in this circumstance. The Yubikey that I keep on my keychain also handles my work 2Fa codes, doesn’t feel necessary to have a dedicated key for that unless my company is willing to pay for it.

Do you just have it on your keychain a plug it in whenever you need it? Because always plugged in keys in your phone or laptop doesn’t really make sense.

It actually works out quite nice having it plugged in all the time, especially if you’re doing multiple 2Fa authentications, the keys won’t authenticate until you enter the password of the key (if you set one up) and touch the key, so even if your computer is compromised they still need to physically touch the key to generate the authentication codes.

As far as I know you can’t just clone a key.

So no you cannot clone a Yubikey to another Yubikey, which I think is dumb, but they have their security reasoning behind it I believe. Like I mentioned earlier all my 2Fa codes/keys are on my keychain so if I break that key I am in a horrible position as I lose access to a lot of accounts that I couldn’t setup multiple 2Fa’s for.

How easy is it to setup a backup key?

While Yubico does recommend having two keys as I mentioned certain services only let you setup 2Fa once and not multiple times. However, Linux (and I want to assume Windows as well) let you setup as many 2Fa keys as you want, so both the Yubikey on my keychain and the one I leave at home both grant Root access to my desktop and server.

I try to not use my phone for critical stuff, but there are times I have to just check an account. Do you use your phone with Yubikeys?

So I don’t have a USB C Yubikey ironically both my iPhone and iPad are USB C so I have the option to use a dongle or NFC, both have worked great, I have had a couple scares where the app will error and say “No response from key” but it seems that error is due to bad contact/connection. I’ve attached a few images of the iOS app to help get an idea of the layout.

5ymm3trY@discuss.tchncs.de on 13 Oct 19:00 collapse

I just realized, the formatting of my last reply got lost somehow, sorry for that. Nevertheless, thank you very much for your response. Really appreciate the insights of a long time user.

I switched from Authy to Aegis like 2 years ago, because I didn’t want to rely on an online service either. Similar to something like Keepass, the database is local and you are in charge of making backups and such. But that is also the great thing about it. If your phone dies you just copy the backup to the new device and your golden. I already thought about the switch to a Yubikey back then, but didn’t go through with it.

With regards to the backup key, Yubikey recommends to save (screenshot) the QR code that is generated during 2FA setup to setup the backup key later on. Maybe that is also a workaround for services that only allow a single 2FA device. https://support.yubico.com/hc/en-us/articles/360021919459-How-to-register-your-spare-key

Yes always plugged in works of course, I just meant that you are somewhat compromising the security that you have gained by using dedicated hardware. But as you said, if touch is enabled and the key is password protected you are probably fine. In the end this comes always down to an optimization problem between security and convenience that everyone has to decided for themself.

ohshit604@sh.itjust.works on 13 Oct 19:17 collapse

With regards to the backup key, Yubikey recommends to save (screenshot) the QR code that is generated during 2FA setup to setup the backup key later on. Maybe that is also a workaround for services that only allow a single 2FA device. …yubico.com/…/360021919459-How-to-register-your-s…

Just looking back at my purchase history, I got my Yubikey’s back in January 2020, it appears that I never read this doc about scanning the QR code for the backup key, or maybe I did? I don’t really remember it all too well. Regardless In certain circumstances my keys do the exact same thing and I’m quite sure I followed some guide to create one primary and one secondary key but it’s possible that guide has gone outdated.

Similar to something like Keepass, the database is local and you are in charge of making backups and such.

I can totally respect the folks who opted to self host, I’m horrible when it comes to backing up data and such and self hosting wasn’t really my thing back in 2020 so it never really was on my radar.

In the end this comes always down to an optimization problem between security and convenience that everyone has to decided for themself.

Couldn’t agree with you more, everybody has that dial between convenience and security and should adjust accordingly.

5ymm3trY@discuss.tchncs.de on 13 Oct 20:51 collapse

Regardless In certain circumstances my keys do the exact same thing and I’m quite sure I followed some guide to create one primary and one secondary key but it’s possible that guide has gone outdated.

Yeah maybe this guide wasn’t there when you bought yours or it is outdated. Problem is, you have to setup the 2FA from scratch for these accounts if you don’t have the QR code anymore. Might still be worth a try to really get two identical keys.

you are in charge of making backups and such. I can totally respect the folks who opted to self host, I’m horrible when it comes to backing up data and such and self hosting wasn’t really my thing back in 2020 so it never really was on my radar.

Aegis is still an app on your phone. It just is not connected to an online service so you control the database file youself. It of course always depends on you setup e.g. if you have a single device that acts as your 2FA “key” and keep offline backups of the database you don’t have to host anything. If you want to authenticate with multiple devices and add new accounts often some form of automatic sync might be helpful. Even though I like the app, I don’t want to convince you of Aegis. I just didn’t want to paint the wrong picture.

MadameBisaster@lemmy.blahaj.zone on 13 Oct 11:43 collapse

Dito, bought two one as backup for the other and its great.

mhzawadi@lemmy.horwood.cloud on 13 Oct 06:24 next collapse

I use freeotp+, but it looks like it could be dead now. But I does have an export to file.

Undaunted@feddit.org on 13 Oct 06:32 next collapse

Yubikeys. I have 2 of them and both have the same entries in case one breaks.

Appoxo@lemmy.dbzer0.com on 13 Oct 06:35 next collapse

Aegis

retro@infosec.pub on 13 Oct 06:36 next collapse

Proton Authenticator. Has both Desktop and Mobile apps. Free. Don’t have to sync to Proton.

hanrahan@slrpnk.net on 13 Oct 08:50 collapse

Do they have a Linux client for the desktop?

retro@infosec.pub on 13 Oct 09:37 collapse

deb, rpm and aur-bin

hanrahan@slrpnk.net on 13 Oct 12:53 collapse

Thanks for the speedy reply. On LMDE so Debian it is.

They have no Linux Drive desktop client, so that was pleasent suprise.

spacelord@sh.itjust.works on 13 Oct 07:05 next collapse

Aegis ♥️

maxwellfire@lemmy.world on 13 Oct 07:57 next collapse

I use bitwaarden and stratum since it has a wearos app as well and it’s nice to use that for 2fa codes

StopSpazzing@lemmy.world on 13 Oct 18:04 next collapse

Started testing out stratum recently…

magguzu@midwest.social on 14 Oct 14:53 collapse

Had to scroll too far for Stratum! The watch app is also why I use it so that I can keep my phone far away from me while I work. Game changer. Surprised more don’t use it.

slazer2au@lemmy.world on 13 Oct 07:59 next collapse

Authenticator and Authenticator.

Damn thoe innovative tech companies, what will they think of next.

Smash@lemmy.self-hosted.site on 13 Oct 08:56 next collapse

Stratum

sbeak@sopuli.xyz on 13 Oct 09:23 next collapse

Aegis seems like a pretty good 2FA app on Android from what I’ve heard. Personally, I use Ente Auth as sync is very helpful when I don’t have my phone nearby (you can either use the desktop app or use your browser, both work). Don’t think you can self-host sync, though I might be wrong. Ente Auth also works without sync, so there’s that.

I would not suggest using a password manager’s 2FA integration (e.g. Bitwarden, I think Proton Pass has one if you use that?) as it kind of defeats the point of 2FA, since if someone got access to your password manager, they would also get the 2FA codes.

sommerset@thelemmy.club on 13 Oct 09:36 next collapse

Vaultwarden, bitwarden does 2fa tokens as well.
I use it now.
I used to use aegis before.

asudox@lemmy.asudox.dev on 13 Oct 11:15 next collapse

I use Aegis on my phone.

BruisedMoose@piefed.social on 13 Oct 12:17 next collapse

Adding to the Aegis chorus.

I also use Proton Pass for some sites that aren’t as critical for me / don’t have a bunch of PII. It’s easy.

Redex68@lemmy.world on 13 Oct 12:50 next collapse

I personally use Ente Auth and quite like it, don’t use syncing and save an encrypted copy to my PC. I really like that you can see what the next code will be.

blackbarn@lemmy.zip on 13 Oct 13:41 next collapse

Vaultwardwn/bitwarden + a yubikey for bitwarden itself and a few others

vrighter@discuss.tchncs.de on 13 Oct 15:02 next collapse

keepassxc and a yubikey. And syncthing to keep all devices in sync

jbk@discuss.tchncs.de on 13 Oct 15:05 next collapse

since no one mentioned andotp i might have to move away from it…

sfjvvssss@lemmy.world on 13 Oct 20:32 collapse

I think it is not maintained any more: github.com/andOTP/andOTP

jbk@discuss.tchncs.de on 13 Oct 21:04 collapse

lol thanks

Curious_Canid@lemmy.ca on 13 Oct 15:33 next collapse

I’ve been using Aegis for several years now without any problems. It replaced the Google Authenticator seamlessly.

suicidaleggroll@lemmy.world on 13 Oct 17:06 next collapse

I used to use 2FAS, but recently switched to a self-hosted instance of Ente

zingo@sh.itjust.works on 13 Oct 18:59 next collapse

Aegis.

I like the auto backup feature (encrypted) . Then the backup is synced to computer via Syncthing.

Set and forget setup.

d3lta19@lemmy.ca on 14 Oct 14:57 next collapse

I also use aegis. Have been for years and it works great

Ohh@lemmy.ml on 14 Oct 19:12 collapse

For me aegis is by far the best. Simple. Encrypted. Backup. It’s saved to a syncthing folder. Passwords are in bitwarden for simpme stuff but keepassxc is great. And also synced via syncthing.

Unlearned9545@lemmy.world on 13 Oct 20:06 next collapse

Bitwarden

ikidd@lemmy.world on 13 Oct 22:00 next collapse

Yah, I can’t see a point to have another app/extension when Bitwarden has it built in, and it’s a great password manager.

ripcord@lemmy.world on 13 Oct 22:12 next collapse

Wait, it does? Including in the mobile app? I don’t see it.

ikidd@lemmy.world on 13 Oct 22:24 collapse

Right under Password in the edit screen of an item: Authenticator Key. You put in the auth key the target site provides you when you enable TOTP and it will start generating timed tokens. Usually you’ll also get a one-time pad of backup keys, I usually toss those in the Notes of the edit screen there as well in case something goes wrong.

lka1988@lemmy.dbzer0.com on 14 Oct 15:18 next collapse

The point of 2FA is “something you have” and “something you know” to enter a secured system.

If you put both of those into one system that is accessible by one password, the whole concept is defeated.

ikidd@lemmy.world on 14 Oct 15:26 collapse

My threat model isn’t having someone take my computer and log into stuff so my concern when using 2FA is more about them having gotten hold of a password remotely. But a TOTP makes that password pretty hard to use, no matter where it’s stored. And my BW is also protected by a Yubi/password combo, so I guess I’m just vulnerable to having that beaten out of me.

lka1988@lemmy.dbzer0.com on 14 Oct 18:53 collapse

The other issue with this - If you lose access to that one system, you’re SOL. It’s a single point of failure.

ikidd@lemmy.world on 14 Oct 20:34 collapse

That I could accept as a good reason.

waspentalive@lemmy.world on 16 Oct 14:37 collapse

But if they get your Bitwarden vault and crack it - they have everything Throw a roadblock in their way - use a separate app for OTP.

Landless2029@lemmy.world on 14 Oct 00:37 next collapse

I’m a little concerned about having OTP and passwords together in one system.

waspentalive@lemmy.world on 14 Oct 15:08 collapse

OTP is on my phone, Bitwarden is on my computer. I don’t use the OTP in Bitwarden.

Landless2029@lemmy.world on 14 Oct 15:33 collapse

This is the way. I use Bitwarden and Aegis.

The issue here is putting Bitwarden on your phone with OTP in Bitwarden.

waspentalive@lemmy.world on 16 Oct 14:36 collapse

On the phone, I use Authy, More eggs - more baskets.

waspentalive@lemmy.world on 14 Oct 15:07 collapse

Bitwarden

Jayjader@jlai.lu on 13 Oct 21:16 next collapse

I use pass for my passwords, and it has an otp extension that I’ve been using more and more. I used to use aegis but I have needed to switch phones one too many times without having access to the previous phone to be comfortable with phones for 2fa.

Of course, this isn’t as secure as a truly separate OTP solution, but it’s still better than no OTP/2FA. And I can easily enough back up and restore my 2fa access over the internet, even on a new computer (albeit I need to also backup a PGP key that can decrypt the password store to truly be portable).

erock@lemmy.ml on 14 Oct 13:34 collapse

This is what I do. If someone can figure out pass with my password protected gpg, plus my passwords are partials (I salt them), and otp then they can have my access

Jayjader@jlai.lu on 14 Oct 14:02 collapse

plus my passwords are partials (I salt them)

I’m curious how you make that work - do you just remember the salts, store them separately, or what? I have like 50-70 passwords in my store currently, there’s no way I’m remembering a (true random) salt for each one.

erock@lemmy.ml on 17 Oct 23:42 collapse

My salt is just a memorized password I put in addition to the one stored in pass

pjusk@lemmy.dbzer0.com on 13 Oct 21:27 next collapse

Woahhh defo not enough love for Ente Auth in tgese comments. Highly recommend! Its got a beautiful and intuitive UI, completely open-source and is back by super active devs and community 💚

jcolag@lemmy.sdf.org on 13 Oct 21:37 next collapse

I primarily use GNOME Authenticator, but after an inopportune crash, I now also run 2FAuth on my home server as a backup, and now just hope that I remember to do the export/import dance going forward.

julianwgs@discuss.tchncs.de on 13 Oct 21:57 next collapse

I use Proton Authenticator on an iPhone without an account and I am satisfied

W4nd3r3r@lemmy.ml on 13 Oct 22:30 next collapse

FreeOTP+

twice_hatch@midwest.social on 14 Oct 15:12 next collapse

Yep f-droid.org/…/org.liberty.android.freeotpplus/

Ohh@lemmy.ml on 14 Oct 19:13 collapse

If i remember correctly sone tokens it can’t read? Cant backup? Clunky interface? I looked at it, but decided against it.

W4nd3r3r@lemmy.ml on 23 Oct 04:20 collapse

Had no issues with FreeOTP+ for a long time, using it for many accounts

ClydapusGotwald@lemmy.world on 14 Oct 11:40 next collapse

Ente

gajahmada@awful.systems on 14 Oct 13:39 collapse

Ente

poolhelmetinstrument@lemmy.world on 14 Oct 14:40 collapse

Ente

agelord@lemmy.world on 14 Oct 14:47 collapse

Ente

antimongo@lemmy.world on 14 Oct 16:31 collapse

Ente

Regulator0394@lemmy.dbzer0.com on 14 Oct 19:59 collapse

Ente

glnpf148@lemmy.world on 14 Oct 20:28 collapse

Gans

lka1988@lemmy.dbzer0.com on 14 Oct 15:20 next collapse

I use Aegis, automatically backed up every time a new key is added. Was using Authy for a while, but they’re going down the enshittification hole, so I dumped them.

NotMyOldRedditName@lemmy.world on 14 Oct 15:59 next collapse

Yubikeys. I think everyone should get a couple (need 2 in case 1 lost)

ChocolateFrostedSugarBombs@lemmy.world on 14 Oct 17:22 next collapse

A combination of Yubikey and Enpass (I got Enpass back when it was $15 for perpetual).

nickiam2@aussie.zone on 14 Oct 17:50 next collapse

Yubikey. It supports TOTP as well as passkeys. Plus is a physical device separate from my phone. Recommend getting 2 to have 1 as backup

bitwolf@sh.itjust.works on 14 Oct 19:01 next collapse

Aegis

MrSulu@lemmy.ml on 14 Oct 20:15 next collapse

Ente Auth

Lettuceeatlettuce@lemmy.ml on 14 Oct 20:40 next collapse

Aegis for time codes, Nitrokey for physical 2FA tokens.

erev@lemmy.world on 14 Oct 20:47 next collapse

Bitwarden as Vaultwarden enables TOTP.

sem@lemmy.blahaj.zone on 13 Oct 01:59 next collapse

Proton Pass is addictive how convenient it is. I use Aegis to log in to proton pass.

gaiety@lemmy.blahaj.zone on 13 Oct 13:59 collapse

despite hosting most things, I still lean into Proton Pass and Mail

they aren’t perfect but I value their services and stick to self hosting less critical things