I own a handy asus x00p with android 8 that fits my hand (released in 2018). I have a newer android 11 device (released in 2020) but it’s larger and heavier and I don’t really like using it.
What are the security risks, if I go ahead using the 2018 model to 2fauthenticate?
If it’s not receiving security patches then it’s not a good candidate to use for 2factor. Risks are low but anything without security patches becomes a minor speed bump to bypass as published exploits will likely exist that are trivial to implement.
None if you keep it offline
I’m gonna have to ask you to elaborate:
how can I keep it offline? I need to keep the device online to receive the code, right?
2fa codes are usually time based. As long as the system time on the device is correct it should be able to generate a matching code
OP never said how they got the codes. Could be SMS.
You can use an OTP Generator like Aegis Authenticator from F-Droid. Afaik it even works offline, so there should be no risk if you strictly keep it offline.
Why would an OTP generator even need connection to anything?
Cloud backup or to download images for the services the code links to.
Both are optional with Aegis, I use Aegis also.
Is it not supported by lineage os?
You are basically fine, especially if the phone is offline as another poster says, and if you don’t have too much potential malware installed. For really high end authentication you wouldn’t want to use a phone in the first place.
Another issue is that if you’re using a phone 2fa app to authenticate a browser on the same phone that has a password manager, that is not really 2fa. You want the second factor to be on a separate device.
