google-authenticator VS Aegis

otpauth:// is a de-factor standard, since Google Authenticator uses it: https://github.com/google/google-authenticator/wiki/Key-Uri-...

Random question if you're using TOTP why not just give the user the secret when signing up as a Google Authenticator URI encoded in a QR code? Then you won't need to futz around with sending it to them afterwards. You can even use a library like qrcode.js so you don't generate the barcode server side either.

Locker can generate Time Based OTP codes parsing TOTP urls stored under a special key named totp.

(Examples> https://github.com/google/google-authenticator/wiki/Key-Uri-Format)

If we're talking about the encrypted Authy TOTP secrets and IF they get cracked or guessed, Authy does store the email in the name of the item. Having the name, service and the secret within the QR code's URI is normal and the standard for TOTP. The only thing the hackers won't have is the password.

For 1Password I use a Yubikey, but for 2FA in general, I have a backup phone running Aegis[1].

[1] https://getaegis.app/

Bottom line is, why in the world would you use a mysterious closed source app when there are better options out there? 2FAS is one of the better ones. Aegis Authenticator is another good choice for Android devices.

You can enable 2fa with amazon I suggest you do that with a 2fa app like aegis, that will greatly increase the security of your account and require the 2fa code to login to your account.

Aegis Authenticator has been a lifesaver for me: https://getaegis.app/

I use Aegis[1] on mobile and OTPClient[2] on my computer, both are regularly backed up on change.

I do not use the TOTP feature in my password manager (though I can split it to new DB in keepassXC) as feel it will defeat the purpose of 2FA.

[1] https://github.com/beemdevelopment/Aegis

Google Authentificator → Aegis