Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Generate shared 2FA codes for your entire team

tfa.one

Post reply on HN
Print view View original

21–30 of 43 posts

Re: Show HN: Generate shared 2FA codes for your entire team

#21

Post by ShakataGaNai »

Totally get the use case for this, lots of shared accounts in IT, been a problem for years that gets solved in a number of ways. Sometimes clever, sometimes barely duct tape.

This is much nicer looking. But... and it's a very big but... why would you trust this service? You're giving random person on the internet your 2FA secret keys. Their TOS & PP don't even mention encryption. I'm not saying you can't do something like this, but I'd be extremely hesitant using something for a very high security purpose that is probably done by one person as an MVP.

There are other options, 1Password and LastPass both support 2FA TOTP codes. If you trust those, they are "better" for security. Do they have some of the features and convenience of this service? No. But at least you already trust them for high-security usage.

Re: Show HN: Generate shared 2FA codes for your entire team

#22

Post by cmeacham98 »

jamesvnz wrote: post #14
chews wrote: post #8

Why not just share the seed for the 2fa with close team members... you have to back it up anyway.

It looks like with this service the user who can generate a TOTP can't see the backing seed. Therefore, if they leave, and get removed from Slack, they can't generate a code. If you just shared the seed then everytime someone left the team you'd need to regenerate.

Is it possible to reconstruct the seed (or some equivalent that would allow you to generate future codes)? If yes, how many codes would you need to do so?

Re: Show HN: Generate shared 2FA codes for your entire team

#23

Post by remram »

Like most of the services popping up around 2FA, now that 2FA is popular: this essentially removes one of the factors.

Whether you're making one of the factors available to everyone on Slack, or putting it next to the password in LastPass, the result is the same, you delete the security benefits of 2FA.

Re: Show HN: Generate shared 2FA codes for your entire team

#24

Post by hansy »

akerl_ wrote: post #19
hansy wrote: post #13

Earlier quoted context omitted.

Using a separate device (yubikey, mobile phone, etc) is always recommended, but this is a bit more secure than meets the eye. Someone would have to get access to your Slack account to view the codes, and to do that, they'd have to first get access to your work email (because Slack is password-less and emails auth links to you).

Slack happily uses passwords; the “magic links” via email are an additive feature.

Oof you're 100% right; definitely missed this.

Re: Show HN: Generate shared 2FA codes for your entire team

#25

Post by _wldu »

hansy wrote: post #17
tialaramex wrote: post #12

It doesn't say, but I presume these are TOTP codes, and there is just a single generator that you're sharing and thus one shared secret. This has some surprising consequences, e.g. a conformant TOTP implementation marks off your recently used codes, making them actually one time , but if a dozen employees log in ready for the 0900 start between 08:59 and 09:01 and need one code each, the system cannot in fact generat…

Yup this is indeed a limitation in that once a code is used, the next person essentially has to wait at least one minute before they can get another working code. My target is smaller teams, where collisions (hopefully) happen less frequently. If you're a bigger org, chances are you also have the resources to just buy everyone their own seat/license to the account instead of relying on the employees to share one acco…

That's a feature (not a limitation) of TOTP. Also, the time step defaults to 30 seconds, but can be changed: https://datatracker.ietf.org/doc/html/rfc6238

My OATH HOTP/TOTP implementations are here:

https://github.com/62726164/oathgen

https://github.com/62726164/goathgen

Re: Show HN: Generate shared 2FA codes for your entire team

#26

Post by tedk-42 »

remram wrote: post #23

Like most of the services popping up around 2FA, now that 2FA is popular: this essentially removes one of the factors. Whether you're making one of the factors available to everyone on Slack, or putting it next to the password in LastPass, the result is the same, you delete the security benefits of 2FA.

Most people have their phone as a 2FA device, but they will login to websites/services on their phone anyway. Would you suggest preventing logins from phones?

The REAL benefit of TOTP is that it's time sensitive. If someone does have your password and TOTP code over the wire, they cannot repeat the attack.

I think this service is fine, but as others have pointed our you're giving away for TOTP secret to a third party which makes them a very good target for attackers looking to score a pot of gold.

Re: Show HN: Generate shared 2FA codes for your entire team

#27

Post by tgsovlerkhgsel »

ShakataGaNai wrote: post #21

Totally get the use case for this, lots of shared accounts in IT, been a problem for years that gets solved in a number of ways. Sometimes clever, sometimes barely duct tape. This is much nicer looking. But... and it's a very big but... why would you trust this service? You're giving random person on the internet your 2FA secret keys. Their TOS & PP don't even mention encryption. I'm not saying you can't do something…

Not just that... you're also sending those 2FA codes through yet another third party service (Slack), so you have two places where your security can be compromised.

Re: Show HN: Generate shared 2FA codes for your entire team

#28

Post by auslegung »

fishtoaster wrote: post #20

This is absolutely perfect for a use case that I've seen a lot: shared test accounts. Eg our app connects to external service X, so we have a staging account set up such that the staging version of our app can operate. But service X values security and requires 2fa on all accounts. This is really annoying, especially if service X is expensive and charges per seat. We don't want to pay for a seat for all of our develo…

Do you know 1password handles storing mfa codes?

Re: Show HN: Generate shared 2FA codes for your entire team

#29

Post by bawolff »

tedk-42 wrote: post #26
remram wrote: post #23

Like most of the services popping up around 2FA, now that 2FA is popular: this essentially removes one of the factors. Whether you're making one of the factors available to everyone on Slack, or putting it next to the password in LastPass, the result is the same, you delete the security benefits of 2FA.

Most people have their phone as a 2FA device, but they will login to websites/services on their phone anyway. Would you suggest preventing logins from phones? The REAL benefit of TOTP is that it's time sensitive. If someone does have your password and TOTP code over the wire, they cannot repeat the attack. I think this service is fine, but as others have pointed our you're giving away for TOTP secret to a third party…

> The REAL benefit of TOTP is that it's time sensitive. If someone does have your password and TOTP code over the wire, they cannot repeat the attack.

Instead they just have your session cookie, which probably doesn't expire for six months.

The real benefit of 2FA is unlike passwords, users cannot make stupid choices, like use the same one for multiple websites or the password "password". The User is usually the weakest link, 2FA reduces reliance on the user behaving appropriately.

Re: Show HN: Generate shared 2FA codes for your entire team

#30

Post by weird-eye-issue »

fishtoaster wrote: post #20

This is absolutely perfect for a use case that I've seen a lot: shared test accounts. Eg our app connects to external service X, so we have a staging account set up such that the staging version of our app can operate. But service X values security and requires 2fa on all accounts. This is really annoying, especially if service X is expensive and charges per seat. We don't want to pay for a seat for all of our develo…

Bitwarden does this too
Post reply on HN