Best way to secure authenticator app itself?

Privacy Questions
1

I’m using Ente Photos and Authenticator, both use the same authenticator code (I initially set it up for photos). Now when i try to log into the auth website it asks for 2fa code which is stored in auth website itself. I have my account logged in multiple places so i can get around that but I’m afraid of getting locked out at some point. How can i secure auth other way? Is there any better approach to this?

2

You can do multiple things:

  1. Save recovery codes that are given while registering Ente 2FA by writing them down, or saving them someplace else.
  2. You can take a backup of Ente Auth and save it on a physical drive (USB, SD card, etc.)
  3. You can have another device and log into Ente Auth on it.
1 Like
3

You can also put your Ente 2FA TOTP key in another 2FA app, by itself. Like Aegis if you are using Android.

I had your issue recently as well. I set up 2FA for Ente Photos and then my Ente Auth needed my TOTP when logging in.

1 Like
4

You also could use yubikey or something like it

5

I use Aegis, and when I’m setting new 2FA credential, I add secret to KeePassXC database (separate from one I use for passwords), so I have it at 2 places (actually on each device I use), plus backup.
It means you have to keep and maintain 2 databases, but quantity is quite small for me (20-25 services), and it’s not I’m changing it often (most likely never)

1 Like
6

Passkey?

7

Thank you. I’ll save a encrypted Backup on cloud and in hard drive

1 Like
8

Hmm i noticed Ente did added passkey support recently. I’ll look into it

9

The best way is to have it in an offline setting.

10

air gapped pass key :thinking:

11

More than enough tbh. Don’t try some of the methods being advised here if your threat model does not call for it. Can become exhausting lol

Unironically the best way in a lot of cases. I would also recommend Ente in offline, non-login mode for people who want extra security. This way you can sync passwords using online password managers, and yet still hold the 2FA credentials offline and on-hand always. Just be sure to take regular backups into physical drives that are not on the same site as you.

A decent alternative to people who might not want to deal with hardware keys. But I also understand most people want to sync 2FA online too, and that’s fine too.

2 Likes