Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TOTP tokens on my wrist with the smartest dumb watch

blog.singleton.io

Post reply on HN
Print view View original

31–40 of 131 posts

Re: TOTP tokens on my wrist with the smartest dumb watch

#31

Post by Brajeshwar »

ayewo wrote: post #26
Brajeshwar wrote: post #22

If you are not that a hacker but already own a Smartwatch such as the Apple Watch, Authy[1] is a pretty rock solid option. I use Authy for a few key credentials, and I have used my watch for the keys. FYI, Authy was bought and is now owned by Twilio 1. https://authy.com

I use Duo Mobile [1] with my Apple Watch. Authy gets recommended often here but got turned off of them because they require a phone number to set up the app on iOS. There's no phone number requirement for TOTP implementations so I eventually found Duo Mobile. This was before they got bought by Cisco. 1: https://apps.apple.com/us/app/duo-mobile/id422663827

Ah! I used Authy because it was one of the very early OGs of TOTP Apps.

Re: TOTP tokens on my wrist with the smartest dumb watch

#32

Post by Cthulhu_ »

Arainach wrote: post #6
trustingtrust wrote: post #4

There needs to be a button based passcode to view TOTP instead of just pressing one button once. That would add a layer of security. A combination of buttons and number of presses should still be somewhat added security.

What's the threat model here? The TOTP code is worthless without the password. You would need to get my password and physically obtain the watch; what threat does a button code protect against? Someone who steals the watch from my house doesn't have the password. Someone who phishes the password doesn't have access to the watch. The government agent who has exerted enough physical force or legal coercion to get me to…

The only added security I can think of on a two factor authentication thing is a fingerprint reader on a physical hardware key, and even that's more of a gimmick than anything. And maybe TOTP codes generated from a password manager, but IMO that already defeats the purpose of two-factor because if your one device with password manager is compromised, they have both password and the second factor.

The four number code IS the added security already.

Re: TOTP tokens on my wrist with the smartest dumb watch

#33

Post by quickthrower2 »

sneak wrote: post #2

Cool hack. That said: A security reminder to anyone who is in the target audience here: if you're clever enough to have TOTP 2FA enabled on your Google account, get some cheap USB security keys and enable Advanced Protection, which completely disables non-hardware 2FA. It requires two different tokens (and you should really get one for each computer you have/use, plus at least one offsite backup) because once enabled…

Not so sure, for me I am going to forget to have the hardware device. I will probably lose it. I will forget to take it with me and then can't access things mobile. Or will take it out with me and lose it. Have enough stuff to keep track of! I would use hardware for some occasional use logins though.

Why is TOTP not much better than SMS? Someone can take over your phone contract to get those SMS messages by sweet talking your telco, but for TOTP they need to get hold of my device or get some malware onto my phone.

Re: TOTP tokens on my wrist with the smartest dumb watch

#35

Post by k8sToGo »

Brajeshwar wrote: post #22

If you are not that a hacker but already own a Smartwatch such as the Apple Watch, Authy[1] is a pretty rock solid option. I use Authy for a few key credentials, and I have used my watch for the keys. FYI, Authy was bought and is now owned by Twilio 1. https://authy.com

I use Authy as well. Best part is it backups your stuff.

Re: TOTP tokens on my wrist with the smartest dumb watch

#37

Post by himlion »

joshxyz wrote: post #13
yellow_lead wrote: post #7

How accurate does the time have to be for TOTP to work? If the watch drifts a bit, will it no longer work? Compared to your phone which is synced with an NTP server.

up to the service. some services allow up to 2 windows.

AWS asks you to sync by inputting subsequent codes if it detects keys from the wrong time window.

Re: TOTP tokens on my wrist with the smartest dumb watch

#38

Post by m4lvin »

Tepix wrote: post #36

Neat. For those who don't want to tinker with hardware (just software) - is there a nice app providing TOTP for the PineTime smartwatch?

Not for PineTime, but the bangle.js has a a 2FA TOTP app: https://banglejs.com/apps/?id=authentiwatch

For InfiniTime (the PineTime firmware), here is the issue/discussion about it: https://github.com/InfiniTimeOrg/InfiniTime/issues/310

Re: TOTP tokens on my wrist with the smartest dumb watch

#39

Post by Maxburn »

k8sToGo wrote: post #35
Brajeshwar wrote: post #22

If you are not that a hacker but already own a Smartwatch such as the Apple Watch, Authy[1] is a pretty rock solid option. I use Authy for a few key credentials, and I have used my watch for the keys. FYI, Authy was bought and is now owned by Twilio 1. https://authy.com

I use Authy as well. Best part is it backups your stuff.

That's the feature that got me into Authy. The other feature being it wasn't a google product.
Post reply on HN