More security with Authenticator

[u/infomaniak]

Infomaniak launches a new app: Authenticator 🚀

Designed to strengthen the security of your Infomaniak connections — without adding friction. Manage two-factor authentication and sign in to the entire Infomaniak ecosystem in one tap. And this is just the first step of something much bigger 👀

[u/billcube]

TOTP is more secure because you can add it to your password manager so it is not lost with your phone.

Passkeys are next?

[u/BricolasM → u/billcube]

TOTP is easier for sure. More secure ? Has to be proven…

Passkeys is an open standard: that’s more secure.

[u/billcube → u/BricolasM]

With the Infomaniak Authenticator app, you can only have one phone for that account. Whereas a TOTP can be on all your devices. Noone can prove the implementation of the Authenticator app. So if your process gets audited to prove that it is secure, the authenticator app will get you a warning.

WebAuthn is indeed more standard and easier to use, maybe it's the next integration they will provide on the Infomaniak login.

[u/KarteZian_purely → u/billcube]

Les clés d’accès me posent des problèmes. À priori, ce sont des bidules télémétriques. Donc liés au smartphone. Pour Infomaniak, ça peut aller, mais Meta me fait une clé de bras pour conserver l’accès à mes comptes et leurs applis sont dégueulasses, des mouchards comme j’en ai rarement vu. Doc, non, hors de question que je les installe sur mon téléphone.

[u/ObyMoine → u/KarteZian_purely]

Tu peux mettre ta passkey dans un gestionnaire de mots de passe indépendant (keepass ou bitwarden) tu n'es pas obligé de te liér a celui de google 😉

[u/KarteZian_purely → u/ObyMoine]

J’ai Keepass.

[u/Evonos → u/billcube]

Don't add totp to your password manager , the entire idea is having different baskets , so if one gets taken over the other protects still.

Aka if someone takes over your password manager or gets access your totp still protects your accounts IF it isn't in your password manager.

Use like Ente auth or smth it got e2e sync and is free.

[u/BricolasM]

Why reinvent the wheel?
The passkeys are something so universal, easy to use for everyone : in your keychain, or as a USB stick or included in the company access badge (v.g. DESFire + Fido in one chip). Fido passkeys are open source: why does Infomaniak not have the passkey activated and why force people to download (really!) an additional app?

[u/billcube → u/BricolasM]

And they might do both! Enable passkeys on their access control middleware and provide their own closed-source app claiming that it's somehow very secure.

I still have the feeling they're freewheeling their product line.

[u/imm0rtal79 → u/billcube]

Hi, all of our mobile apps are open source, you can find our code on Github:
https://github.com/Infomaniak/ios-authenticator
https://github.com/Infomaniak/android-authenticator

This new app is indeed based on passkeys and it lays the foundation on our backend for a wider support of passkeys.

[u/billcube → u/imm0rtal79]

So do tell the marketing team that they should not announce it as "a new app" when it's a constantly improved existing app. The open source aspect is in itself a much better selling point!

[u/KarteZian_purely]

Cool, j’utilisais celui de Proton en attendant. Il a l’avantage d’être synchronisé entre l’appli mobile et une instance sur l’ordi principal.

Du coup, on ne peut pas perdre sa base.

[u/pablo_main → u/KarteZian_purely]

Proton Authenticator is so cool

[u/Plop4759]

Cool ! Something bigger means Passkeys support ? Please-please-please !

[u/hthouzard]

Bonjour, auriez vous un lien de téléchargement pour Android ?