3

I have been using FreeOTP by Redhat/Fedora for a few years now as my main two way authentication app. However, I have realised that the current version (1.5) is quite a few years old (having been released in 2016).

https://freeotp.github.io/

https://f-droid.org/packages/org.fedorahosted.freeotp/

There is however a forked version; FreeOTP+. This fork's latest update (1.7) came out in December of 2019, making it far more up to date than the upstream app.

https://f-droid.org/en/packages/org.liberty.android.freeotpplus/

I am however concerned about security, due to the app playing a very important role in account security. I am also unsure as I am not too familiar with the work/trustworthiness of the developer of the fork (I mean him/her no offence when I say this, I'm just cautious when it comes to account security), where as I know Redhat to be a secure and freedom respecting company.

So which would be the safer option? Should I stick with the older FreeOTP? Do two way authentication apps need to have up to date security patches? Or can I trust the more up to date FreeOTP+?

Also, even though I appreciate the help and good intentions of people who would recommend this; but please don't recommend that I use the Google or Microsoft authenticators instead. I want to use a Free/Open Source authentication app rather than a proprietary one.

2
  • In a quick check of the latest commits of both projects I have not seen any commits that target a security issue. The original FreeOTP project has not released anything for the last years, however it is still actively developed on Github. Therefore there is the third option to clone the repo and build your own version.
    – Robert
    Feb 23 '20 at 15:20
  • @Robert hey thanks man, so any of the options are good options?
    – AdLinux
    Feb 24 '20 at 21:56
5

Generally I would say that both are secure.

FreeOTP: Developed by Fedora by RedHat. So by a prop. company. But it's open source for everyone, that means if there would leaks to RedHat the FLOSS-Community would reported that to F-Droid and News Pages. That would a big scandal for RedHat and many people would lose trusting Fedora. Second, it's unmaintained. They deliver some commits, but not releases that F-Droid can build. I guess OTP doesn't offers security issues.

FreeOTP+: A maintained fork of FreeOTP. It's developed by a private person, Howard Liberty. It offers updates. But like at FreeOTP, the community would find issues if your pricacy isn't secure. F-Droid would disable these version (if they find some issues).

But there are also other 2FA Applications that are open-source available (and installable in the offical F-Droid repo):

OTP Authenticator: A basic client, but doesn't offers new commmits. Developed by Bruno Bierbaumer. Last commit/release at Dec 23, 2015.

andOTP: Active fork of OTP Authenticator. They continue the upstream. The latest release was on Oct 28, 2020. But they offer new commits. It has the a big community at GitHub (2.8k stars). Main developer is Jakob Nixdorf.

Aegis Authenticator: This is 2FA by Alexander Bakker and Michael Schättgen. In my eye it looks a bit properitary, but hasn't any trackers since it's available in F-Droid. It has 1.6 stars on GitHub.

(Google) Authenticator: You sad that you don't want the Google Authenticator as answer. But this app is by google and is open source. F-Droid's latest version was at 2012. But their repository offers commits and releases from 2019. This is a "fork" of the prop. Google Authenticator available on the prop. Play Store. It's not sure, if there is a codebase of the offical app or receives updates by the prop. App. I'm not sure, if there are trackers. (But I think so.)

I personally use FreeOTP+. But I can also suggest andOTP. I'm looking to switch to cotp. cotp is a Command-Line tool developed for the computer. And maybe able to use with Termux

3

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.