You should probably define "OTP" somewhere on the page. Maybe just spell it out "One Time Password (OTP)" the first time you use it.
Thanks for the feedback! I feel so dumb, gonna fix first thing in the morning :)
Show HN: Auto-OTP: automatically send and receive OTPs, end-to-end encrypted
11–17 of 17 posts
Re: Show HN: Auto-OTP: automatically send and receive OTPs, end-to-end encrypted
#12I built something similar with Shortcuts or whatever the iOS automation thing is called. 1. Receive otp 2. Launch automation which posts entire message content to url 3. Broadcast message to other people in my circle. It works fine so long as my OTPs arrive correctly.
Hey, that’s pretty cool!
I have a question about your method - Are all messages broadcasted to the server? If only the ones with an OTP, are OTP messages for all apps broadcasted to those people?
In Auto-OTP, the OTP can be forwarded to different people app-wise. For example, you may choose who should receive the OTP for app1, who receives for app2 etc.
Re: Show HN: Auto-OTP: automatically send and receive OTPs, end-to-end encrypted
#13Can someone explain what the use case for this is? I clearly am not the target audience as I've never forwarded an OTP... but I'm curious what other people are doing that makes this needed.
Hey!
The primary use case is for multiple people wanting to access an account that is behind 2FA.
Example of such folks are - 1) My dad wanting to access my bank account details without having to trouble me 2) Me wanting to login to my brother’s OTT accounts (hotstar, prime etc.) 3) CAs needing bank access for small business owners
Re: Show HN: Auto-OTP: automatically send and receive OTPs, end-to-end encrypted
#14So this automatically degrades 2-factor to… 1 factor again. The security model doesn’t instill a lot of confidence in me, being that you expect user-interaction as a means of security. It’s already bad enough people are tying their OTP with their credentials in password managers…
It’s still 2 factor, just that a few permitted people have access to the one time password. It’s identical to manually sharing the OTP, just automated.
> The security model doesn’t instill a lot of confidence in me, being that you expect user-interaction as a means of security.
Could you please elaborate on what this means?
Re: Show HN: Auto-OTP: automatically send and receive OTPs, end-to-end encrypted
#15I built something similar with Shortcuts or whatever the iOS automation thing is called. 1. Receive otp 2. Launch automation which posts entire message content to url 3. Broadcast message to other people in my circle. It works fine so long as my OTPs arrive correctly.
Hey, that’s pretty cool! I have a question about your method - Are all messages broadcasted to the server? If only the ones with an OTP, are OTP messages for all apps broadcasted to those people? In Auto-OTP, the OTP can be forwarded to different people app-wise. For example, you may choose who should receive the OTP for app1, who receives for app2 etc.
I have a rule which searches for the keyword OTP in incoming SMSes so not all messages get forwarded.
With this Shortcut her information is posted to a url, iOS requires the user to click okay to execute the action. So, you still have control on whether a message gets broadcast or not.
E.g., if a friend messages me asking “hey, did you get the OTP?”, my shortcut will prompt me to broadcast the SMS via the url but I can choose not to.
Re: Show HN: Auto-OTP: automatically send and receive OTPs, end-to-end encrypted
#16Earlier quoted context omitted.
Hey, that’s pretty cool! I have a question about your method - Are all messages broadcasted to the server? If only the ones with an OTP, are OTP messages for all apps broadcasted to those people? In Auto-OTP, the OTP can be forwarded to different people app-wise. For example, you may choose who should receive the OTP for app1, who receives for app2 etc.
I have a rule which searches for the keyword OTP in incoming SMSes so not all messages get forwarded. With this Shortcut her information is posted to a url, iOS requires the user to click okay to execute the action. So, you still have control on whether a message gets broadcast or not. E.g., if a friend messages me asking “hey, did you get the OTP?”, my shortcut will prompt me to broadcast the SMS via the url but I c…
Oh, that's amazing! Thanks for the reply :)
Re: Show HN: Auto-OTP: automatically send and receive OTPs, end-to-end encrypted
#17So this automatically degrades 2-factor to… 1 factor again. The security model doesn’t instill a lot of confidence in me, being that you expect user-interaction as a means of security. It’s already bad enough people are tying their OTP with their credentials in password managers…
It’s still 2 factor, just that a few permitted people have access to the one time password. It’s identical to manually sharing the OTP, just automated. > The security model doesn’t instill a lot of confidence in me, being that you expect user-interaction as a means of security. Could you please elaborate on what this means?
they are describing a trend where security is omitted or skipped because it’s inconvenient. even though OTP is used to increase security, it’s inconvenient for people so they go around it like this.