TOTP tokens on my wrist with the smartest dumb watch

Cool hack. That said:

A security reminder to anyone who is in the target audience here: if you're clever enough to have TOTP 2FA enabled on your Google account, get some cheap USB security keys and enable Advanced Protection, which completely disables non-hardware 2FA. It requires two different tokens (and you should really get one for each computer you have/use, plus at least one offsite backup) because once enabled it actually and completely locks anyone out of the account that does not possess one of the enrolled tokens.

https://landing.google.com/advancedprotection/

TOTP is not much better than SMS-based 2FA. It's still vulnerable to phishing, local device malware (that attacks your TOTP in your password manager), etc. It's best to use hardware tokens everywhere that support them, and both Google and GitHub do. (And Google supports a special hardware token only mode which I wish more sites would adopt.)

There needs to be a button based passcode to view TOTP instead of just pressing one button once. That would add a layer of security. A combination of buttons and number of presses should still be somewhat added security.

What's the threat model here? The TOTP code is worthless without the password. You would need to get my password and physically obtain the watch; what threat does a button code protect against?

Someone who steals the watch from my house doesn't have the password.

Someone who phishes the password doesn't have access to the watch.

The government agent who has exerted enough physical force or legal coercion to get me to cough up the password can demand the TOTP code at the same time.

> TOTP is not much better than SMS-based 2FA. It's still vulnerable to phishing, local device malware (that attacks your TOTP in your password manager), etc. It's best to use hardware tokens everywhere that support them, and both Google and GitHub do. (And Google supports a special hardware token only mode which I wish more sites would adopt.)

Since this device doesn't actually have network connectivity he might have this problem potentially when someone is watching his watch with a camera, or if someone is able to do something in his close proximity, which means it absolutely is better than SMS-based 2FA and the phishing attack vector is different and if a person has access to him in close proximity anyway the cheap USB security doesn't offer anything(well not completely true, but almost) over this particular TOTP use case.

Security is kinda cool these days and everyone is a security expert, but just reiterating trained responses without actually thinking about the attack vectors is getting a bit annoying. It's as if it is cool to say the most secure use case people can think of without even considering what and who it is that is actually protected and from whom.

Up to the authenticating service