Hey y’all!
I’ve been using Authy for some time now (switched from Google Authenticator) but an increasing amount of people is suggesting Aegis over Authy in some posts here at Lemmy and that got me curious.
Was wondering what would be the main selling points for one to use Aegis instead of Authy, can somebody help out?
Thanks in advance!
This is an easy one.
The entire privacy policy of Aegis:
Aegis Authenticator does not collect any data from your device.
- Camera access is only used for scanning QR codes.
If you believe this policy has been violated, please let us know.
Relevant parts of Authy’s privacy policy:
We use that phone number to identify you, to provide you 2FA services, and to maintain logs for security and anti-fraud purposes.
We may also send notices about Twilio products or events to you, but you may click on the unsubscribe link that will appear at the bottom of any of our marketing emails or you can contact customer support to opt out.
Device Information. When you download and open the Authy desktop or mobile app, we automatically collect information about the type of device you have downloaded the app on and your device identifier.
Login History and Authy Account History. When you use an Authy token to log into an account, whether the token was generated on the app or one sent to you via your phone number, we collect and keep information associated with your login activity including information like your IP address, what application you logged in to, that you logged in, and when. If you change your phone number or email associated with your Authy account, we will also keep a log of that.
Geolocation information. If you have location services turned on, we collect your location based on your IP address.
How we share personal data. In general, Authy shares personal data in the same way Twilio does (see How Twilio shares personal data for more).
From “How Twilio shares personal data”: However, we do need to share it in some circumstances. These may be to provide you services (e.g., to route a call or send an email), or when necessary for our suppliers to provide services to us, or for another reason listed here, or share personal data for cross-context behavioral advertising.
However, Authy users should be aware that an application that integrates with the Authy 2-Factor API can access your phone number, email address, and user name. It will also be able to access your primary device type and information associated with your login activity to that application. It may also retain this information on its own servers. We may also share other information related to your account with that application to help them and us detect suspicious or fraudulent activity on your account.
The main point is that Authy is a company that hosts your data on their cloud and you can’t know what they do with it. Aegis is local, but has the ability to create scheduled backups, which then you can sync to your own server or just copy it in different locations for safety.
Authy locks you in and intentionally makes it very hard to export keys. I made the mistake of using it once years ago and it was annoying to get out of it.
Aegis works the best for me, it is specifically for power users because it allows sharing of the seed phrase quite easily. So may not be for users who don’t understand that part. But for me has been a godsend. I am trying to get my parents on a better 2fa standards. And it works because I scan and setup 2fa first on aegis and then share it to their authy. They find authy useful and I’m not worried about them accidently sharing seed phrase.
For backups, aegis does automatic backups to local storage and next cloud syncs it to my cloud. It is encrypted so you can use something like foldersync to sync it your gdrive or mega or something like that.
Aegis is not multi platform, but I honestly don’t care, in my opinion it’s better to have aegis on my phone and when I need to login from a desktop, looking up the code in phone is a separate device factor which adds on to the security. Meaning if somebody knew my passwords and stole my laptop, they’ll still have to steal my phone to access 2fa. Different story if they steal my phone though.
There are desktop apps that can import the Aegis backup file to display the 2FA codes on Debian I’m using Authenticator
Aegis may import and export seed with easy. I switch from Authy to Aegis just for this. It also have automatic backups. Authy only selling point was the sync function and maybe the bad desktop app. Now I had a double backup, the native function, and a synced keepassxc file with all the Aegis OTP exported for desktop use. KeepassXC support OTP export with QR so I can create there and export to Aegis if I want. Best solution ever.
