Disclaimer: This post is about cloud-based TOTP apps, so please don’t mention any locally stored options here.
I recently made a post about how Proton Authenticator meets all the requirements to be on PG’s recommended MFA list. But, I didn’t get any clear response from the PG team.
So I’m making this post to clear up one of my doubts regarding storing 2FA seeds. I want to use a cloud-based TOTP app, and Ente Auth, Proton Authenticator are the only two privacy friendly options right now. So I’m slightly confused about which one I should go with.
Here are answers to a few common questions I believe others will definitely ask in the comments.
Why not a local 2FA app like Aegis? I’m a multi-mobile user — I use an Android and an iPhone together, and there’s no single main device I carry all the time. So storing 2FA seeds in a local TOTP app and then syncing the database across devices is a big hassle for me. From past experience, I’ve never been able to properly maintain latest offline databases across devices, so I’m looking for a cloud-based solution over local apps.
Why not just pick one blindly, since both are from reputed providers? I’m already using other services from both providers (Ente Photos and Proton Mail). I don’t want to store my 2FA seeds alongside my other data, like mail or photos, so I’d have to create a second account with either provider to store my 2FA seeds. So for me, both look exactly the same — either way, I have to create a second account.
Ente Auth has been in the market for a long time, so why not just go with it? I agree it’s been around since 2023, but my thinking is that Ente doesn’t has any other privacy-focused services, like a password manager or email, so Proton might have better privacy and security overall, given it offers a wider range of privacy services compared to Ente. Though it has now been proven that Proton can’t stand by their own words many times.
Why not just pick the one you trust more? Honestly, I trust both Ente and Proton, and at the same time, I don’t fully trust either. I already try to maintain an up-to-date backup of my database in case the service ever goes down. The problem with cloud-based services is their lot of dependencies and if even one small thing breaks, users are stuck suffering until the provider fixes it on the urgent basis.
Why not store 2FA seeds in a password manager? Firstly it’s not recommended, and I’m also not comfortable storing my 2FA seeds alongside my login credentials in my password manager. If I did that, I’d only need one service — my password manager — to access all my accounts.
That’s all from my end. Let me know which one I should pick between Ente Auth and Proton Authenticator. Thanks
Do you use TOTP codes from your authenticator for Proton or Ente? If you do I’d suggest using the authenticator that’s not made by that company. If you use TOTP codes for both services I’d suggest Ente as TOTP codes + photos can do a lot less damage when compared to TOTP codes + email.
I ended up using a KeePass-like app for 2FA, and I think there are significant updates coming to 2FA apps in general.
We’re currently in a weird position where three 2FA standards are pretty common:
— TOTP
— Passkeys (which either bypass 2FA or work as a TOTP replacement alongside passwords)
— Hardware tokens
In these circumstances it makes a lot of sense to have one app that can store both TOTP and passkeys. No authenticator app can do this as far as I know, only password managers. And KeePass has the advantage of keeping the 2FA database on the phone only, without exposing it to desktop or web access and without storing 2FA and passwords in the same app.
Bitwarden Authenticator is a third option if we take “cloud-based” in a narrow sense. 2FAS and KeePass are also cloud-based when you store the database in cloud storage, but I’m not sure that makes them “cloud-based” in your terms.
That’s why I’ll use a second account for storing 2FA seeds on the cloud.
Actually, I’ve added my family members to my paid Ente plan, so I don’t want to store 2FA seeds in the same Ente account.
For Proton Authenticator, I’ll never store my 2FA seeds along with my mail in the same account, so I’ll have to create a second account for storing 2FA here as well.
Exactly, it’s always recommended to set up multiple ways of 2FA. So, even after the passkey revolution, TOTP will still be used as a fallback 2FA option. And with hardware keys, TOTP is already being used as a second 2FA option. So, TOTP verification functionality is not going away anytime soon.
It makes a lot more sense to store 2FA in a local app, but due to my bad habit, I’ve already lost all my TOTP seeds in the past, and it was a horrible experience recovering those accounts. I couldn’t recover a few accounts either, because I neglected to store the 2FA recovery keys for those services. Since then, I’ve never taken the risk of storing anything locally only. I do use KeePass now, but as a backup for my password manager. If the cloud-based service ever shows any error, I can complete my work via KeePass. But if you’re asking me to use a local app as my primary option, I’m not ready to take that risk again.
As far as I know, TOTP seeds can’t be directly added to Bitwarden Authenticator (at least with cloud sync enabled). So basically, I have to use the main Bitwarden password manager to store the TOTP seeds, which I can then access from different devices via Bitwarden Authenticator.
I have the same doubt regarding Proton Authenticator as well, but I couldn’t find anything that proves it syncs the TOTP seeds with Proton Pass.
Yes, you’re right. I’m looking for an out-of-the-box solution where I can add TOTP seeds from one device and they’ll automatically pop up on the second device without performing anything extra. 2FAS and KeePass look good but I really hate the hassle of the initial setup, along with the risk of running into errors while uploading the database to the cloud and later accessing it from there. Cloud-based services, on the other hand, are hassle-free and carry a much lower risk of synchronization errors.
That’s how I understand it too: Bitwarden password manager to sync with the cloud, Bitwarden Authenticator to view. Or a paid Bitwarden plan to view them in the main Bitwarden app as well
2FAS has the option to backup to iCloud and Google Drive (meaning it can be cloud based as well, told you that already in other thread). If you choose this cloud sync it works without the need to perform manual steps every time to sync the database. Please do not spread missinformation anymore.
Actually, I recently switched from Bitwarden to 1Password — autofill detection didn’t work most of the time in Bitwarden, which pushed me toward this transition.
I’m looking for a dedicated cloud-based TOTP app. Using Bitwarden Authenticator while storing TOTP seeds inside the Bitwarden password manager isn’t something I feel comfortable with.
Initially, I thought Proton Authenticator stored TOTP seeds within Proton Pass, but I recently found out that both use separate storage for their data.
Yeah, so to summarize my point: I think that currently dedicated authenticators do not cover all 2FA standards, so password managers should be used instead: one PM for passwords, another one for passkeys and TOTP (if the user prefers not to store them together)
Sorry for my mistake. I previously tried setting up the KeePass + Google Drive combo on my Android device, and it didn’t work somehow. So I assumed that restricting Google Drive’s background activity was what broke the synchronization. But I was wrong. After reading your comment, I looked into this further and found that synchronization still works even if the cloud storage app is uninstalled. Thanks for pointing out my mistake.
Now, coming to your comment — I don’t feel comfortable going with the local TOTP app + third-party cloud storage route anymore. I’m looking for something easier to use, an out-of-the-box solution, so I’m sticking to cloud-based services only.
I am not sure how it works with KeePass, I am correcting the part regarding how it works with 2FAS.
Also, no matter which app you choose, you’ll be putting your data into a third-party cloud. If you choose Proton Authenticator, it will be either iCloud or Proton’s cloud. Proton also can be used offline, but that’s not what you’re interested in.
personally I already use Proton for drive and email, I don’t really want to use them for much more than that.
depends entirely on what you want to go with mate, ultimately, they are both free and open source trusted projects.
there are stories of people’s protons accounts getting delete for no reason so if you had all your eggs in that basket could suck pretty hard. on the off chance that happens, i wouldn’t want to lose my email and 2fa at the same time, those are two pretty important things. but you can also use proton auth without cloud sync too, so it really depends on implementation and what your priorities are.
edit: I use their Calendar too. I moved to Tuta calendar cos I didn’t like that Proton’s isn’t open source but as much as I wanted to like it, after a few months of use, it’s just too buggy.
The Proton Authenticator is an app that is entirely separate from your Proton account (not even requiring to sign in). If you do so, it’s only for the optional sync.
The question would be if you have enough redundant backups (preferably encrypted), so that you don’t lose ‘one copy’ of all your seeds.
Yeah I imagine the majority of users would be using the sync and not backing up though. The target audience is definitely users seeking convenience / ecosystem integration.