I am using Android and would like my TOTP seeds offline only. Is there any reason to use Ente over Aegis in this case? Is it better maintained or more well audited or anything?
I would say go for Aegis since you want an offline only 2FA app. Ente is good for if you want “offline mode” but may want to sync your codes to your other devices down the road
I use Aegis with Syncthing to sync my codes between devices
They are both good apps. We recommend ente mostly because it has a sync option and well many people don’t arrange backups otherwise.
Do you also recommend using both at same time for the same providers/sources? I mean, having it as some sort of backup from each other.
I don’t really see the case for that. If you have backups you can always import in the other.
It is more important you keep things on multiple devices.
It was just a thought that crossed my mind. We store keys for each item, this is to help we recover in case we remove or loose access to them but if we keep two distinct multifactor authentication (of course in more than one device) and if we by mistake we delete one entry and notice immediately before sync or loose access to the entries in one of them, we would have a quick backup.
I think backups are for that.
Your intuition is right. MFA implementations provide a set of “recovery codes” (ideally preserved non-digitially) per enrolled shared secret. This is better than backups or sync and the like, e2ee or not. Shared secrets are better protected when known to absolutely minimum number of custodians.
Ente Auth’s e2ee sync adds usability (albeit, at the cost of increase in attack surface, which isn’t a good or a bad thing, but a thing that might matter in conservative threat models, especially when the alternative in recovery codes are just as usable).
If your goal is to keep them fully offline (and no cloud involved) then you should use Aegis and keep the backup on as many devices as you have.
You should periodically backup it on the separate device that is kept outside of your living space but yet in the accessible location. This should be done incase of bulgary, fire, flood etc
Why Aegis though? What makes it superior to just using Ente offline
You might check out the features of each to see if that sways you one way or another. I don’t think you’ll go wrong either way.
Just use Ente if you don’t trust your own backup methods (infrequent, unreliable, or completely absent).
Aegis has decent backup choices that can be set and forget - great for non-power users. Google auto backup (good if using Android - ex, buy a new phone, set it up, and Aegis will just be there), creating and versioning a backup file in any mobile folder (makes for easier transferring), etc.
Ente recently got a few months ago multi file backup to a folder.
It comes down to taste between Ente and Aegis. I give my parents Aegis on their phones as I can’t rely on them adding a new code and getting file backups off the device.
I think Ente Auth in offline-only mode (network permission disabled if you have GOS) might be more secure, because Ente has a sustainable business model to hire full-time security professionals to patch security vulnerabilities.
Also, Ente Auth was third-party audited. Audits are extremely expensive, so community run projects like Aegis usually can’t afford them.
This is exactly what I was suspecting. I like Aegis a lot, but I have no idea who runs it. Ente, on the other hand, is worked on full time by people who have a sustainable business model. Definitely something to think about.
If I’m understanding this suggestion from Android correctly, Ente doesn’t follow this best practice for Android app security in at least 2/4 of their apps(I haven’t checked locker or ensu but I assume it’s the same).
You can visit any site on the web within Ente Photos or Ente Auth because the in app help pages are on their help pages and then you can go to their main website and then GitHub or YouTube. I got to Google search.
I found this because I was trying to remove browsing from my phone so I checked all my apps.
WebView objects in your app shouldn’t let users navigate to sites that are outside of your control. Whenever possible, use an allowlist to restrict the content loaded by your app’s WebView objects.
https://developer.android.com/privacy-and-security/security-best-practices#webview
Aegis seems to send you to your web browser with its links like this one:
Aegis has reproducible builds at least at the time at the end of this issue but the developer was not so interested.
https://github.com/beemdevelopment/Aegis/issues/1244
I don’t see anything to suggest that Ente has them. They used to on FDroid but i don’t really know about that because it stopped testing the recent releases maybe after they failed a certain number of times.
nice finding thanks for sharing