Aegis: Description for F-Droid release

[jokay]

Would be great to have a description for Aegis release on F-Droid :wink:

[alexbakker]

We already have the summary and description in the metadata folder of the repository. We're just waiting for F-Droid to pick it up!

[jokay]

What about error 404 and f-droid issue 349?

Remove it to re-add it? :wink:

[alexbakker]

I don't know what the issue is. It picks up the screenshots just fine. There appear to be no public logs, so we'll have to wait for someone from F-Droid to look into it.

See also: https://gitlab.com/fdroid/fdroiddata/issues/1579#note_155715853

[Rudloff]

What about error 404

It does not seem to be specific to this app, the website does not update correctly anymore and we need to figure out why.

[rugk]

Especially I would be interested on why I should use this (TOTP) app instead of all there alternatives that are already on F-Droid like FreeOTP or andOTP…

[alexbakker]

@rugk

I'm not going to try to sell you on Aegis. If you'd rather use a different app, that's totally fine. That said, if you take a look at the feature list in the README, you'll quickly see that Aegis has a lot more features than FreeOTP. The comparison to andOTP has been discussed on Reddit before, so I'll quote the response to that here:

We were actually already working on Aegis when we first found out about andOTP, and the feature-sets seem to overlap quite a bit. For us, it's mostly about security. andOTP does not support using fingerprint and password unlock at the same time. With just fingerprint unlock, you run the risk of Android deleting the key that is used to encrypt your tokens when changing the security settings of your device, which means you lose access to all of your tokens. Aegis does not have this issue, as it would still be possible to decrypt your tokens with the password in such an event. This means you can safely use fingerprint unlock with Aegis, while it is risky thing to do with andOTP.

andOTP also does some pretty scary stuff with regards to its use of cryptography. It's been a while since I've looked at the code, but andOTP appears to derive the key for the encryption of backups with a single iteration of SHA-256, making a brute-force attack on backups a lot easier than it should be. In another piece of the code it splits the output of PKBDF2, which also gives attackers an advantage. The latter is not nearly as bad as the former, but it's still bad practice.

We also think that Aegis has a nicer UX.

[rugk]

Great, this needs to be reflected in the f-droid description (without calling names though, but just list advantages e.g.).

[jokay]

@rugk @alexbakker Well using andOTP you are now able to use OpenKeychain to create PGP encrypted backups which is very nice.

I like the good system integration from andOTP which uses device credentials and Android KeyStore instead of a custom password unlock.

If the fingerprint isn't working or anything else, you can restore a PGP encrypted backup :wink:

This is was made me finally change from FreeOTP to Aegis to andOTP.

[alexbakker]

The app now has a summary and description on F-Droid. I made some mistakes with the formatting, which I'll fix later.