google-authenticator VS decrypt-otpauth-files

otpauth:// is a de-factor standard, since Google Authenticator uses it: https://github.com/google/google-authenticator/wiki/Key-Uri-...

Random question if you're using TOTP why not just give the user the secret when signing up as a Google Authenticator URI encoded in a QR code? Then you won't need to futz around with sending it to them afterwards. You can even use a library like qrcode.js so you don't generate the barcode server side either.

Locker can generate Time Based OTP codes parsing TOTP urls stored under a special key named totp.

(Examples> https://github.com/google/google-authenticator/wiki/Key-Uri-Format)

If we're talking about the encrypted Authy TOTP secrets and IF they get cracked or guessed, Authy does store the email in the name of the item. Having the name, service and the secret within the QR code's URI is normal and the standard for TOTP. The only thing the hackers won't have is the password.

I used OTP Auth.app (https://cooperrs.de/otpauth.html) for many a while years on iOS and then on macOS too.

Now I've mostly transitioned to using the built in OTP handling in Keychain. Every so often I find one I haven't migrated across yet.

Another option is HE's NetWork Tools iOS app, which also has an OTP Authenticator in it. I believe it's a lot less integrated though (I don't think it provides a browser plugin, for example).

Forget all the cloud-based Authenticators and use OTP Auth. https://cooperrs.de/otpauth.html

I have been using OTP Auth for a while. It doesn't get updated a lot but it's working fine.

https://cooperrs.de/otpauth.html

I do that using a separate app, (OTPAuth for iOS), and pretty much for the same reason.

OTP Auth Website

Good point. See also the developer's website: https://cooperrs.de/otpauth.html

Sure, that's a possibility. I believe it is developed by a single person. But the OTP Auth app allows you to export an encrypted backup that can be decrypted using an open source tool available here: https://github.com/CooperRS/decrypt-otpauth-files. Also, the OTP Auth app lets you view the original secrets (and display QR codes) used to create the TOTP entries. So it would be relatively easy to simply scan the QR codes with whatever new app you wanted to use in the future. In my book, that makes OTP Auth the safest option because I am guaranteed an easy way to migrate to a new app if I ever need to do so. ... Also, OTP Auth lets you have folders (in addition to searching), which is really helpful if you have a lot of 2FA accounts.

This is the best iOS answer. One of my most favorite apps. https://cooperrs.de/otpauth.html

OTP Auth. https://cooperrs.de/otpauth.html For iOS and macOS