beemdevelopment / aegis

A free, secure and open source app for Android to manage your 2-step verification tokens.

Aegis Authenticator

Aegis Authenticator is a free, secure and open source 2FA app for Android. It aims to provide a secure authenticator for your online services, while also including some features missing in existing authenticator apps, like proper encryption and backups. Aegis supports HOTP and TOTP, making it compatible with thousands of services.

For a list of frequently asked questions, please check out the FAQ.

The security design of the app and the vault format is described in detail in this document.

Features

• Free and open source
• Secure
  • The vault is encrypted (AES-256-GCM), and can be unlocked with:
    • Password (scrypt)
    • Biometrics (Android Keystore)
  • Screen capture prevention
  • Tap to reveal
• Compatible with Google Authenticator
• Supports industry standard algorithms: HOTP and TOTP
• Lots of ways to add new entries
  • Scan a QR code or an image of one
  • Enter details manually
  • Import from other authenticator apps: 2FAS Authenticator, Authenticator Plus, Authy, andOTP, FreeOTP, FreeOTP+, Google Authenticator, Microsoft Authenticator, Plain text, Steam, TOTP Authenticator and WinAuth (root access is required for some of these)
• Organization
  • Alphabetic/custom sorting
  • Custom or automatically generated icons
  • Group entries together
  • Advanced entry editing
  • Search by name/issuer
• Material design with multiple themes: Light, Dark, AMOLED
• Export (plaintext or encrypted)
• Automatic backups of the vault to a location of your choosing

Screenshots

Downloads

Aegis is available on the Google Play Store and on F-Droid.

Verification

APK releases on Google Play and GitHub are signed using the same key. They can be verified using apksigner:

apksigner verify --print-certs --verbose aegis.apk

The output should look like:

Verifies
Verified using v1 scheme (JAR signing): true
Verified using v2 scheme (APK Signature Scheme v2): true

The certificate fingerprints should correspond to the ones listed below:

Owner: CN=Beem Development
Issuer: CN=Beem Development
Serial number: 172380c
Valid from: Sat Feb 09 14:05:49 CET 2019 until: Wed Feb 03 14:05:49 CET 2044
Certificate fingerprints:
   MD5:  AA:EE:86:DB:C7:B8:88:9F:1F:C9:D0:7A:EC:37:36:32
   SHA1: 59:FB:63:B7:1F:CE:95:74:6C:EB:1E:1A:CB:2C:2E:45:E5:FF:13:50
   SHA256: C6:DB:80:A8:E1:4E:52:30:C1:DE:84:15:EF:82:0D:13:DC:90:1D:8F:E3:3C:F3:AC:B5:7B:68:62:D8:58:A8:23

Icon packs

Aegis supports icon packs to make it easier to assign icons to the entries in your vault. There are no official icon packs, but the community maintains a number of third-party icon packs you may want to check out. To learn how to create your own Aegis-compatible icon pack, see the documentation.

• aegis-icons

  Unofficial monochrome-styled 2FA icons.

  

• delta-aegis-icons

  Delta version of the unofficial monochrome-styled 2FA icon pack aegis-icons.

• aegis-simple-icons *

  This project periodically generates an icon pack for Aegis based on Simple Icons.

• aegis-simple-icons-outlined *

  This is a variant on the aegis-simple-icons pack where the icons contain no solid background and just the outlines are being used.

* The icons are automatically generated, so not all of them are as high quality as the ones you'll find in aegis-icons.

Contributing

Looking to contribute to Aegis? That's great! There are a couple of ways to help out. Translations, bug reports and pull requests are all greatly appreciated. Please refer to our contributing guidelines to get started.

Swing by our Matrix room to interact with other contributors: #aegis:matrix.org.

License

This project is licensed under the GNU General Public License v3.0. See the LICENSE file for details.

aegis's Issues

Add amoled / true black theme

Set FLAG_SECURE on every window

See also: https://developer.android.com/reference/android/view/WindowManager.LayoutParams.html#FLAG_SECURE

Lock the database after x minutes of inactivity

Last slide of onboarding process is missing an icon

Thanks for submitting the first translation! A small part seems to be missing though:

Thanks for submitting the first translation! A small part seems to be missing though:

<string-array name="authentication_methods">
    <item>Нет</item>
    <item>Пароль</item>
    <item>Отпечаток пальца</item>
</string-array>

Other than that, this looks good to me.

Originally posted by @alexbakker in #41 (comment)

Incorrect token for imported authy

I previously imported authy via andotp which I then imported into aegis, then I noticed that the token was wrong. Could you please consider adding authy support next for those 2fa which only option is via authy such as twitch, thanks.

Add support for Microsoft Authenticator's "phoneauth" URIs

Microsoft's MFA implementation uses a different URI format in their QR codes than the usual Google Authenticator ones.

The URIs have the following format: phonefactor://activate_account?code=123456789&url=https%3A%2F%2Fsomething.phonefactor.net%2Fpad%2F987654321.

This needs more investigation, as it's possible we can't even derive enough information from the URI to generate codes without an API call to Microsoft.

See also: https://docs.microsoft.com/en-us/azure/active-directory/user-help/microsoft-authenticator-app-how-to

Save the database file atomically

It would be nice to be able to prevent database file corruption in the event that an unexpected shutdown occurs while we're still busy writing the database file to disk. Android has a utility class in its standard library that implements atomic file writes, called AtomicFile.

See also: https://developer.android.com/reference/android/support/v4/util/AtomicFile

No progress bar

This is on a Pocophone F1 - screenshot of the top screen

The intro doesn't show the app icon

The margin of the icon in EditProfileActivity is slightly off

Have tapping on a code copy it rather than open the menu.

Right now, when you tap on a code, it opens a menu with the options "copy", "edit", and "delete".

Given that after initial setup, users are almost always going to want to copy the code, can you make it so tapping on a code copies it, and long pressing on the code opens the menu?

This is how LastPass Authenticator does it.

Not all strings are defined in strings.xml

They should be. This will allow us to easily add localization in the future.

Allow switching from an encrypted database to a plain text database and vice versa

ImagePicker in the EditActivity has the wrong color

Dark mode in main menu, doesn't work if you don't have any entries.

I noticed that dark mode does not become enabled until you add some entries to Aegis. If you don't have any accounts in Aegis and you select dark mode, the main menu does not use the dark theme.

This is a minor issue, but it would be good to fix for the sake of consistency.

Thank you for you work on this. I am probably going to switch from AndOTP. I like the UI more and I am hoping there will be more active development with Aegis.

Rename "Night mode" to "Dark mode"

HOTP support

Night mode is broken in most views

Support importing encrypted andOTP backups

Screenshot: https://i.imgur.com/wCYO7OS.jpg

Prompt the user about unsaved changes when closing SlotManagerActivity

Add an option to change the password

Add an option to hide codes by default and reveal them only when tapped

Improve entry group management

Support for entry groups is fairly basic currently.

• Create a separate DatabaseEntryGroup object for groups
  • Fields: UUID, Name
• DatabaseEntry
  • Refer to groups by their UUID instead of their Name
  • Allow assigning an entry to multiple groups
• EditEntryActivity
  • Allow assigning an entry to multiple groups
• GroupManagerActivity
  • Require the user to click a "Save" button before actually saving any changes
  • Warn about unsaved changes by showing a "Discard changes?" dialog
  • Add the ability to rename groups
• MainActivity
  • Support selecting multiple groups to filter on
  • Persist the selected group filter

Alternative Download Source

Would you mind providing the APK for those not using Playstore? For example, attach them to your releases (I could then automatically pick and provide them via my repo), or even going for the official F-Droid repo?

Thanks for considering!

Header: distinguish timer and top panel

In both Dark and Light modes timer indicator has the same color as the top panel:

Perhaps, it can be green or red (or any other color different from the blue spectrum).

Crash when restoring EditEntryActivity from savedInstanceState

This appears to be a bug in KropView. See: avito-tech/krop#14.

Support importing from FreeOTP+

Import json backup from FreeOTP+ is not possible.

Enabling fingerprint fails with IllegalBlockSizeException

On latest F-Droid build, attempting to enable fingerprint unlock results in an IllegalBlockSizeException popup. logcat shows success from FingerprintService followed by E keystore: getAuthToken failed: -3.

Let me know if I can somehow gather additional logs or try different crypto parameters somewhere. Device is Xperia XZ running 8.1, fingerprints are working for device unlock.

Update to SDK 28

We need to wait for the final release of the Android support libraries because of this bug: https://issuetracker.google.com/issues/111662669.

Allow storing the database on external storage

Perhaps this should only be allowed for encrypted databases.

Option to backup to Google Drive/OneDrive/Other Cloud Storage

As the title says, this feature would provide for peace of mind to users of the application, in addition to exporting to the phone's local storage. 👍

Add support for importing from Google Authenticator

This will require root access, as Google Authenticator doesn't have an export option.

Can't translate themes and view modes in settings

In the settings screen the 'Theme' and 'View mode' settings, and its available options, are not translatable.

Support importing encrypted Aegis databases

Hide 'advanced' OTP fields by default in EditProfileActivity

Allow switching to the front-facing camera in the camera view

Description for F-Droid release

Would be great to have a description for Aegis release on F-Droid 😉

Auto-lock if the app is closed or after a minute

I feel like the app should "auto" lock when you close it, or when you don't open it for a minute or 30 seconds. At the moment, if I don't press the lockpad button it stays open forever.

Make text less cryptic

A lot of the language used for crypto-related actions is too cryptic for the average user. Nobody knows what "Deriving key from password" means, for instance.

Is there any plan to add a desktop app for macOS?

The "discard changes" dialog is shown for new empty entries

Dialogs don't respect the dark mode setting

And this solution doesn't work on KitKat: https://github.com/alexbakker/Aegis/blob/e3c4f4b1f6da84488dd723dd77107cca2f571d60/app/src/main/java/me/impy/aegis/ui/EditProfileActivity.java#L56

The "Encryption" step in the intro activity has multiple issues

There are three issues here:

1. The image is pixelated on KitKat (probably because we're using app:srcCompat without setting android.defaultConfig.vectorDrawables.useSupportLibrary to true)
2. This image doesn't really fit in here in the first place
3. The radio button list overflows into the bottom bar

Smaller boxes and text

I would love to be able to make the boxes, images, text, etc. a bit smaller. At the moment I just feel like everything is incredibly big. Would it be possible to add a size setting? To jump between. I still want to see the images though, so maybe just a smaller image, since the image is way faster to recongnise what the code is for. :)

Only show the key slots menu in debug builds

Importing an entry with a non-unique UUID causes a crash

Metadata fix path

from metadata/en-US
to metadata/android/en-US

Ref: https://github.com/fastlane/fastlane/blob/2.28.7/supply/README.md#changelogs-whats-new

Ref: https://gitlab.com/fdroid/fdroiddata/issues/1579

Add quick sorting options

I know you can hold and drag entries to sort them, but having an option in the top bar to sort entries would help with longer lists.

This can include normal/reverse alphabetical, date added, list items in groups next to each other or separate, free sorting like what currently exists, etc.

Maybe even have new entries automatically sorted based on what mode you have selected.

Can't import andotp backups that include steam

A buddy of mine went to switch from andotp and he got "an error occurred while trying to parse the file: unsupported otp type: steam"