Giters

beemdevelopment / Aegis

A free, secure and open source app for Android to manage your 2-step verification tokens.

Home Page:https://getaegis.app

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

adding more security, usb token access

f1-outsourcing opened this issue · comments

commented

I am a little worried about that if your phone is unlocked or remotely hacked your stuff can be easily accessed. What about having an encryption key stored on a external usb pen drive and only with this usb pen drive inserted, the encryption key is available to unencrypt aegis files and access is possible.

commented

I don't think other apps have this option. I think it is quite nice! ;)

commented

Thanks for the suggestion, but I don't agree this adds any meaningful security. This is essentially equivalent to a very strong passphrase. You can actually already achieve something like this if you really wanted to, by configuring a Yubikey as an HID keyboard and having it output a strong password to unlock Aegis.

I also think we would be able to count the number of people who would use this feature on one hand.

commented

It definitely adds meaningful security. You don't have to enter in public a password, that could be visually recorded. Furthermore keys are not really brute forced, passphrases are done with dictionaries.
I am not familiar with yubikey. Having the usb drive is easier and available to everyone. Everyone has one lying around. The key file is always better than strong passphrase. People are not using it because nobody is offering it.
5 years ago nobody was using OTP, TOTP, so it is not really argument that maybe people would not use it. keepass also has this feature of being able to unlock a db several ways.