Oracle Mobile Authenticator vs Yubico Authenticator

Oracle Mobile Authenticator provides a second verification method for signing in to applications protected by multi-factor authentication. After enrollment, it generates passcodes and can receive push notifications. Oracle says one-time passcodes can be generated while offline, but registering for push notifications and running device compliance checks require an online connection. The app uses a secret key to generate OTPs and receive push notifications, and Oracle lists app protection policy, compliance policy, and silent key refresh among its security features. For Oracle IAM passcodes, other authenticator apps that follow TOTP can also be used; Oracle Mobile Authenticator is required for push notifications. Passcode sign-in requires a synchronized device clock, with a maximum permitted difference of 90 seconds. On Surface Pro or Windows Desktop, enrollment needs a manually entered key or enrollment URL because of a QR scanner camera limitation; manual keys must use BASE32. For Oracle Cloud Infrastructure MFA, users can register one device. If it becomes unavailable, an administrator must disable MFA before re-enrollment. The app is listed as free for Android, iOS, and Windows.

Yubico Authenticator generates two-step verification codes for online accounts on mobile and desktop devices. It supports TOTP and HOTP, and users can add credentials by scanning a service’s QR code. Credentials are stored in a YubiKey secure element; Yubico says they cannot be extracted. Since the credentials remain on the portable YubiKey, the same codes are available through the mobile and desktop apps. The mobile app supports tap-and-go authentication on NFC-enabled devices, and credentials can be added with a YubiKey touch or NFC tap. Yubico says users can unlock a YubiKey with Face ID or Touch ID. The app can display OATH codes and manage a YubiKey’s FIDO PIN or perform a factory reset. It is free and open-source software, listed at free, for Windows, macOS, Linux, iOS/iPadOS, and Android. Generating and displaying OATH credentials with the desktop app requires a YubiKey.