Ente Authenticator (2FA)

Site Development Tool Suggestions
21

Hey everyone, here’s the complete changelog for v2.0: Auth v2

@jonah if there’s anything you’d like us to improve further, do let us know!

7 Likes
22

First of all thx for v2.0. A suggestion can be the possibility to group the codes like in 2FAS

2 Likes
23

Blocking screenshot and hide from recent app thumbnail would be very cool.

1 Like
24

Also Tab-to-reveal, Minimize-on-copy, etc features like in Aegis help upgrading user privacy and security much, so please consider adding them in ente Authenticator.

25

Hey, thanks for sharing your feedback, here are our roadmap entries:

Will prioritize these in our next sprint :slight_smile:

8 Likes
26

This is (now?) optional

1 Like
27

Was already mentioned

28

This makes the best alternative to RaivoOTP I had seen so far

29

Is it recommended to avoid creating an account and using offline mode on one device in order to avoid increasing the attack surface? Or is Ente Authenticator’s sync solution secure enough that it is not that much of a risk to access your tokens on the web for example?

1 Like
30

IMO and many will disagree, it is probably fine, 2FA codes aren’t useful by themself and in the case that the codes do get leaked you will be fine as long as you are using good password hygiene. That is the point of 2FA.

4 Likes
31

That is true. Come to think of it, I haven’t actually read someone be against cross-platform 2FA apps. I read that using Signal across two devices in not recommended due to increased attack surface and incorrectly assumed the same can be said for 2FA apps. If anyone is actually against cross-platform 2FA, would you mind mentioning why that is?

32
33

Hi Vishnu,

I’d suggest adding PIN, limiting the attempts to some number (5, 3, whatever) before falling back to entering the password.

One use case is when the user gets robbed and was forced to hand the device PIN over. So, if the user uses a different PIN for ente, then it’s most likely the adversaries can’t get to all the 2FA tokens. With biometrics/device PIN backup access, they can export the entire database.

This would be in line with what some password manager, like Bitwarden, does: allowing PIN access, falling back to the password after some attempts.

34

@Polymer7229 Would this work similar to a duress pin? As used by the strongbox password manager.

35

No, I wasn’t even thinking that far ahead, though I did misunderstand a bit how things worked a few days ago.

  1. Some Android apps use biometric authentication, but allow the device PIN to unlock them. This is no good if you’re forced to hand over the device PIN. Strongbox duress PIN is a step further. Nice.

  2. Some apps authenticate primarily by PIN, but these could be vulnerable to keyboard simulator attacks. It would be better for security apps to fall back on a password after too many PIN attempts.

  3. Some people may not trust their biometric hardware, and an app PIN seems like a reasonable third factor (albeit password-backed) for getting into a security app.

37

ente Auth will be added to the site in 8f565e6, so I’m locking this discussion as completed :slight_smile:

@Polymer7229 Feature requests for ente Auth can be posted to their GitHub issues page. Otherwise they’re off topic here on this forum unless one of the ente Auth developers opens a thread in Project Showcase, because otherwise we have no way of knowing that the developers will see posts here.

Obviously if anyone has feedback to add about ente Auth that would change our recommendation then feel free to open another thread.

2 Likes
38