I currently use Authy on my android and my Linux system.

It syncs every new authenticator between my devices but I dont want to trust companies with my security anymore.

I host a nextcloud instance on my homelab. Does anyone know a good FOSS authenticator that can use my nextcloud to sync between Linux and android? Provided that it is available on both of course.

Thanks for any input!

  • ikornaselur@lemm.ee
    331·
    1 year ago

    Have you checked out Aegis?

    Edit: I missed the Linux requirement, not sure if Aegis works with that in mind

      • lemmyvore@feddit.nlEnglish
        8·
        1 year ago

        You can use OTPClient on desktop, it can import Aegis encrypted exports.

        It’s what I do, my TOTP codes originate on the phone because I scan the QR codes with it, but Aegis is set to export a backup each time something changes.

        A sync app (FolderSync) runs every night and gets the export to my server, where it gets picked up for offline backups.

        I load the latest export in OTPClient only as needed, when I run into a 2fa which is not there.

        Both Aegis and OTPClient can be set to ask for password each time you open them.

    • Cargon@lemmy.ml
      14·
      1 year ago

      This is what I used as well (KeePassXC specifically), with Syncthing sharing the .kdbx file across devices.

    • daco@lemm.ee
      5·
      1 year ago

      I’m using this with Nextcloud through WebDAV.

      There is a keepass app in Nextcloud to access your keepass database using a web browser (keeweb), keepassXC has a client for Linux, Mac and windows (and all of them work great) and there are many apps for iOS and android.

      I use the free version of Strongbox with WebDAV and I haven’t had any problems.

      You can just backup the keepass database file and you can also have several databases. Each database has its own password.

  • confusedbytheBasics@lemmy.worldEnglish
    20·
    1 year ago

    Self-hosted Bitwarden. I just pay $10 for their pro hosted version because they’ve not given me any reason to doubt them yet but I hear self-hosted is easy.

    • Giddy@aussie.zoneEnglish
      7·
      1 year ago

      Yup Vaultwarden (the self host server) is easy to run in Docker and works well with the Bitwarden apps

    • TheButtonJustSpins@infosec.pubEnglish
      4·
      1 year ago

      I’m probably going to upgrade to the pro as well. If they go weird, I’ll probably swap over to Proton Pass, just because I already have access to it, and I’m scared to self host my password vault.

  • SGG@lemmy.worldEnglish
    141·
    1 year ago

    I use vaultwarden (open source implementation of bitwarden server). Yes it’s a seperate service to manage, but it’s a dedicated password/secrets manager that can do otp codes.

    I’ve been running the docker container for a few years now and it’s been rock solid.

    • RandomLegend [He/Him]@lemmy.dbzer0.comOP
      6·
      1 year ago

      Interesting… I found the idea of hosting my own password manager daunting. What if I mess up, lose access, etc… But now a days I believe to have a solid setup, more understanding… Guess I could go that route

      • russjr08@outpost.zeuslink.netEnglish
        4·
        1 year ago

        The bitwarden clients themselves do keep a cached version of the database every time there is a successful sync to the server, so if you were to take the server offline you could still view / export the data thankfully! You cannot make changes to the database according to that page and my own experience, though others have reported that they are able to. Additionally, it looks like this cache does expire (30 days on desktop, 90 on mobile).

        Just make sure to not log out completely (this is not the same as locking the vault, which is fine), this wipes the cache immediately.

      • SGG@lemmy.worldEnglish
        3·
        1 year ago

        Losing things is one of the risks of any setup. With paid for services you are putting trust that the provider has put in place methods to prevent downtime/data loss. Self-hosting means the onus is on you. Make sure you document things, make sure you have some kind of backup in place, and update things regularly (but maybe not straight away, just in case).

        Also expect to occasionally run into weird issues that you need to figure out a fix for. I am 99% sure it was for my NextCloud-AIO setup a year or so ago, but there was an update to it that broke the setup if you had created the containers previousy at a certian time. You needed to run a particular command inside one of the containers to fix it up.

        There was also the time where I migrated things off a physical server to a VM, but missed the script that was doing my certbot DNS challenge renewal. I had not documented things back then and a few months later all my services stopped working, that took a bit to re-do.

        I do make sure to keep backups of my VM’s, and for the VPS I run I pay a bit extra for vultr to keep backups/snapshots there. Along with actual documentation of how I did the setup, I’ve got things stable for the most part.

        Here’s my Heimdall homepage to give an example of different services I run, as well as some links to other websites. Blanked out a few things for privacy and eyepatch reasons (not sure if that’s allowed here).

        • RandomLegend [He/Him]@lemmy.dbzer0.comOPEnglish
          1·
          1 year ago

          Yeah i had some issues once when i ran all my services inside a VM on TrueNAS. Some config prohibited it from using too much of the CPU and it locked up the Ubuntu install all the time… fun times.

          Now i have 3 physical servers and run 36 services and what not…nothing of this is critical for my security though. As there is more to it than just making sure you keep your servers running and accessible. I know how to fix most of the stuff that could go wrong. I don’t know how to stop a malicious actor that wants to fuck with me…and there is my dilemma. A big company (in my case 1password) has teams full of security specialists. They are more hard to crack than i could ever be… but since they’re big they are also a bigger target. And with their team-size the risk of social engineering also goes up. It’s a dilemma^^

          Btw. are you the SGG from Garuda-Linux?

  • Nils@feddit.de
    7·
    1 year ago

    I personally use Bitwarden for my 2FA needs. As others mentioned you can self host the server but personally I have no reason not to trust their SaaS solution, especially now that they offer EU hosted servers. If all you want is a basic authenticator app that does only one thing give FreeOTP a try, it’s made my RedHat. You can then sync the applications state.

    • Cralder@feddit.nu
      4·
      1 year ago

      I use bitwarden for 2FA as well. The only issue I have is that I need another solution as well since I also have 2FA activated on my bitwarden account. You can’t have bitwarden 2FA saved on bitwarden. (Well you can but that’s obviously a bad Idea)

      • asudox@lemmy.world
        2·
        1 year ago

        Then I guess use a hardware key for Bitwarden and 2FA (saved in Bitwarden) for the websites that don’t support it. Or bitwarden could implement something like 1Password’s second password mechanism. That would most likely solve tge 2FA issue.

      • Nils@feddit.de
        1·
        1 year ago

        That is true. But that’d be the case for any online/cloud 2FA service. So you could either have a local 2FA app just for Bitwarden or set up less secure but more convenient email 2FA.

  • 👁️👄👁️@lemm.eeEnglish
    83·
    1 year ago

    I just bitwarden pass manager to store all my 2fa stuff. I just let the company host my account, but if you don’t want that then you can self host your own bitwarden server for free. It’s very convenient, especially with the autofill on desktop and mobile.

  • Dsklnsadog@lemmy.dbzer0.com
    4·
    1 year ago

    I’m surprised no one has recommended “2FAS” yet. It’s the open-source alternative. The app is primarily designed for mobile, but they also offer a browser extension that you could install on Linux if you wanted to. Personally, I always try to keep my 2FA apps unsynchronized with a desktop PC.

    Oh, and you can export your secrets at any time. Not like Authy.

  • Extras@lemmy.today
    3·
    1 year ago

    Make a kdbx vault just for your totp seeds that way you only need an editor, like keepassdx for android or keepassium for ios, and keepassxc for desktop

  • kraxyk@beehaw.org
    31·
    1 year ago

    Personally I would use andOTP on my mobile with backups and use OTPClient on my computer. I don’t like having my 2 factor auth stored in the same system as my passwords. Because if the password manager was ever lost or stolen you’d have all your eggs in one basket essentially.

    • n2burns@lemmy.ca
      3·
      1 year ago

      Copied from my other comment in this thread:

      andOTP is no longer maintained, so it’s not a good suggestion and you should probably see about migrating to another app. I personally went to Aegis and had a smooth transition.

      • kraxyk@beehaw.org
        12·
        1 year ago

        While that is true, there have been many discussions about if there are any known security vulnerabilities or new spec changes that would cause a problem. The consensus from the community is that it is safe to use for quite some time. Not invalidating your points in any way just putting out what I know.