Quote from: Welsh on January 14, 2018, 12:23:27 PM

This shouldn't be the case and especially so with an authenticator.

If an authenticator has a predecessor of the name Google, users would go for it. However they might not go for authy or something in the first place when they know something called "Google Authenticator", exists. Plus, most websites who have 2FA enabled recommended Google Authenticator.

Quote from: Welsh on January 14, 2018, 12:23:27 PM

The main reason why I wouldn't use Google authenticator or Authy is because it's not open source. There's open source alternatives which have been mentioned above which are simply better. Before you say Google authenticator is open source, the app which you download on the store is not.

Also, for their multi device feature to work, then your keys need to be stored on a server for it to work. So they certainly keep records/data. These are encrypted by the backup password you set. This is encrypted using AES and a randomly generated salt using PBKDF2. So the data is stored otherwise, it wouldn't be possible to restore access using another device.

True that. Google is highly overrated in some places and authy which I have been using does need a replacement.

Quote from: LeGaulois on January 14, 2018, 12:33:56 PM

I think it's the best alternative but yeah I admit it looks like a prototype from 2000. There is a tutorial if I remember so you can make your own from scratch.
There are other USBs more "swag" for example FIDO U2F Security Key from Yubico https://www.yubico.com/

Yubiko is nice because it has a USB type C, so I did like that. But 50-60$ for an authenticator, I'm not sure yet but I do want to buy one.
Anyhow, thank you for sharing that information, was really helpful. Cheesy