rust-u2f
Aegis
rust-u2f | Aegis | |
---|---|---|
8 | 297 | |
285 | 8,002 | |
- | 2.8% | |
5.4 | 8.6 | |
3 months ago | 9 days ago | |
Rust | Java | |
Apache License 2.0 | GNU General Public License v3.0 only |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
rust-u2f
-
Software U2F with Fingerprint (On Linux)
This project aims to support U2F / FIDO2 using fingerprint reader on Linux (via libfprint). The goal is to have the same user experience with 2FA using Windows Hello.
This project is based on https://github.com/danstiner/rust-u2f with minor modification (see my fork: https://github.com/ngxson/rust-u2f-pkexec)
Link to the project: https://github.com/ngxson/softu2f-fprintd-docker
- The mechanics of a sophisticated phishing scam and how we stopped it
-
Apple, Google, and Microsoft commit to expanded support for FIDO standard
I've considered adding FIDO2 support to the software-only U2F token I wrote ( https://github.com/danstiner/rust-u2f). It's a fair bit of work though, and I am not sure how comfortable I am with passwordless login unless the keys are kept purely in hardware such as a TPM.
That said, my reading of this post is that FIDO2 support will get built into Chromium directly, which is itself open source. Or if you do want a hardware key but running open software, I'd definitely recommend https://solokeys.com/, I've been following them for a long time.
Also there was some related discussion on this same article last week: https://news.ycombinator.com/item?id=31274677
- Apple/Google/Microsoft to accelerate rollout of passwordless sign‑in standard
- Howdy – Windows Hello style facial authentication for Linux
-
Google is going to ban “less secure sign in method”
On a Workspace account you only need U2F token emulator (https://github.com/danstiner/rust-u2f woks fine) and thenn you can setup u2f first and add normal TOTP in second step. But u2f must stay there. I don't have a personal account to try if it works the same.
-
Ask HN: Is Google phasing out Authenticator/TOTP?
As it becomes easier to emulate hardware tokens[1], Google may start limiting which ones it accepts. I believe they can use attestation keys to do that.
This is just a softer layer of security to slow down less sophisticated mass signup attempts.
They may very well eventually phase out TOTP, under the justification that it is not as secure, but I would be shocked if they ever retire the highly insecure SMS verification.
TOTP is really easy to implement, and adds a ton of value. I have a oneliner that takes a screenshot, extracts the QR code with zbarimg, and adds it to my pass[2] password database, which then hooks back into my browser. I use it whenever it is available because it is so low effort.
[1]: https://github.com/danstiner/rust-u2f
-
Does 2FA actually prevent phishing?
GitHub has a couple of others listed, but I have not tested them personally: Example https://github.com/danstiner/rust-u2f
Aegis
- Degoogling in 2024
- Aegis v3.0 – a free, secure and open source 2FA app for Android
-
End of Life for Twilio Authy Desktop App
For 1Password I use a Yubikey, but for 2FA in general, I have a backup phone running Aegis[1].
[1] https://getaegis.app/
-
Are there good alternatives to Google for 2FA?
Bottom line is, why in the world would you use a mysterious closed source app when there are better options out there? 2FAS is one of the better ones. Aegis Authenticator is another good choice for Android devices.
-
Amazon Account with unauthorised purchases, did my google passwords get leaked
You can enable 2fa with amazon I suggest you do that with a 2fa app like aegis, that will greatly increase the security of your account and require the 2fa code to login to your account.
-
PSA: Some Pixel owners still can't dial 911 during an emergency
Aegis Authenticator has been a lifesaver for me: https://getaegis.app/
-
Ask HN: How do you deal with TOTP 2-factor auth?
I use Aegis[1] on mobile and OTPClient[2] on my computer, both are regularly backed up on change.
I do not use the TOTP feature in my password manager (though I can split it to new DB in keepassXC) as feel it will defeat the purpose of 2FA.
[1] https://github.com/beemdevelopment/Aegis
-
All my Open Source App Alternatives
Google Authentificator → Aegis
- Offline Device to backup MFA seeds
- Ist sonst noch jemand genervt von diesen Authenticator-Apps von Microsoft und Google?
What are some alternatives?
OpenSK - OpenSK is an open-source implementation for security keys written in Rust that supports both FIDO U2F and FIDO2 standards.
andOTP - [Unmaintained] Open source two-factor authentication for Android
secretive - Store SSH keys in the Secure Enclave
google-authenticator - Open source version of Google Authenticator (except the Android app)
Coze - Coze is a cryptographic JSON messaging specification.
AuthenticatorPro - 📱 Two-Factor Authentication (2FA) client for Android + Wear OS
wasmer - 🚀 The leading Wasm Runtime supporting WASIX, WASI and Emscripten
Bitwarden - The core infrastructure backend (API, database, Docker, etc).
solo1 - Solo 1 firmware in C
keepassxc - KeePassXC is a cross-platform community-driven port of the Windows application “Keepass Password Safe”.
CozeJS - Coze Javascript - cryptographic JSON messaging specification
ios-application - A native, lightweight and secure one-time-password (OTP) client built for iOS; Raivo OTP!