Security and Privacy Failures in Popular 2FA Apps

Privacy
1

https://www.usenix.org/conference/usenixsecurity23/presentation/gilsenan

PDF: https://www.usenix.org/system/files/usenixsecurity23-gilsenan.pdf

image
image1237Ă—736 173 KB

image
image1795Ă—781 256 KB

Table 1: Overview of the backup mechanisms supported in each app. Y* indicates that there is a serious security flaw in the
implementation and/or usage of cryptography (see Section 5.3). Y^ indicates support for multiple types of encrypted file exports
(see Section 5.3.4). Values in parentheses were obtained from documentation and observation only (see Section 6.4).

Aegis seems to score the best out of all TOTP apps.

6 Likes
2

Whwre is ente, bitwarden, aithenticator pro??

3

If you mean Bitwarden’s premium TOTP feature, they excluded TOTP in password managers. If you mean the Bitwarden Authenticator app that was released recently, it was released after they had searched for 2FA apps. The same with Ente Auth as that was released in December 2022, a year after they searched for 2FA apps.

4

Some of the problems that were mentioned have already been fixed. For example, the “Y*” problem for 2FAS has already been fixed.