Authenticator VS andOTP

Have you considered https://authenticator.cc/ ?

I realize it is amusing to even consider offloading OTP generation to a web browser extension however, if `$work` doesn’t want to provide you with the correct hardware (e.g. Yubikey, NitroKey, etc.) there are boundary-respecting alternatives

No. It only proves that TOTP, as implemented by mobile apps, is useless against phishing.

The extension from https://authenticator.cc, with smart domain match enabled, would have caught this by showing all other TOTP codes besides the one intended by NPM.

On a Mac, Keychain would also have caught this by not autofilling: https://support.apple.com/en-ph/guide/passwords/mchl873a6e72...

Check this out: https://github.com/Authenticator-Extension/Authenticator

I use a browser extension from https://authenticator.cc/

While I do not know whether its UX is similar, it does have a sync feature (but not cross-browser), an export feature, can backup its data to Google Drive, can store everything encrypted (but not by default), is recommended by at least one government website (SSS Employer Portal in the Philippines), and is there for a long time. Oh, and it also remembers which site each secret comes from, and hides others.

> If you are unable to use the Authy mobile apps, we recommend you look in to alternative desktop products such as the following suggestions:

> https://authenticator.cc/

Currently, I'm using the Authenticator.cc browser extension on the same device for TOTP. However, I imagine security will eventually tighten and running authentication app/protocols on the same device that is logging in wont be an option.

The recommended extension is Authenticator, and it is compatible with Chrome, Firefox and Edge.

I've got a situation where we have a couple of staff that can't install MS authenticator; no smartphone. In some ways I'm jealous of them. Anyway, wife's company is of significant size and she passed off their docs on the issue and they use authenticator.cc browser extension for these situations. I tested it myself, and it works. It's just the raw OTP and not a number entry challenge.

I love F-Droid and try to use apps from there whenever possible.

I did recently discover that andOTP is no longer maintained, though. I've switched to Aegis since.

https://github.com/andOTP/andOTP

I use andOTP[0] which auto-exports an encrypted backup to a local folder, which is then synced with Syncthing[1] to my NAS.

It's seamless and doesn't need an internet connection.

- [0]: https://github.com/andOTP/andOTP

- [1]: https://syncthing.net/

- AndOTP github project is archived in june 2022: https://github.com/andOTP/andOTP

I used FreeOTP before that, which is also fine. I switched because maintenance had been fairly uncommon and there were some minor issues bugging me, but it seems to have picked up again recently, and it's backed by Red Hat as an entity for better or for worse. andOTP is officially deprecated, so I recommend switching to either of those.

At the moment this works with encrypted backup files from andotp and aegis and it totally fullfills my lazyness needs. :)

I was happily using andOTP but seems like it has been unmaintained since June - https://github.com/andOTP/andOTP.

I wish F-Droid or Play Store had a feature like GitHub's 'Archived' to inform users.

You can use whatever 2FA you want, but you need to extract the secret key for it using some scripts. i did it a while ago and i have both blizzards and steams 2fa on Aegis on android, also works in KeepassXC. I think the 2fa app needs to have support for it but it works. https://github.com/andOTP/andOTP/wiki/Shared-secrets

I would switch to andOTP since it allows you to export the keys.