Is there some Unix-ish tool to generate these TOTPs on a laptop? I don't like to keep the 2nd factor on a small mobile device that is easy to lose. So I ask about a laptop tool. By Unix-ish I mean something that is small and does one thing well. Like pipe in a secret to it and it gives me a TOTP? Pipe in multiple secrets and it gives me multiple TOTPs? Then I don't have to remain beholden to a custom encryption forma…
TOTP tokens on my wrist with the smartest dumb watch
51–60 of 131 posts
Re: TOTP tokens on my wrist with the smartest dumb watch
#52Earlier quoted context omitted.
I use AndOTP on Android. You can export to a PGP-encrypted JSON file so your keys are really your own and not locked into a walled garden like Authy.
AndOTP is great. Especially if you compare it with all the iOS options. iOS TOTP apps all suck, it's amazingly bad. I installed like ~15 different ones. After the fifth try, I just had to know if it was just my poor initial selection or a general problem. Each and every iOS TOTP app has at least one crucial problem - requiring a subscription, mandatory sync to a proprietary cloud, having no export-import, not having…
iOS's security makes a self-hosted/non-third party backup/sync super difficult IIRC. (Unless you use Apple's product) I think unless the app has it built in, it's not easily doable. Android can use syncthing, but even Google is making that more and more difficult with each release.
Is there a standard app developers can use to securely sync/backup to for self-hosters? Is there a 'nice' UX/flow to connect apps to s3-style storage (enabling folks to use AWS/DO/Backblaze/whatever?) or would that be too raw?
Re: TOTP tokens on my wrist with the smartest dumb watch
#53If you are not that a hacker but already own a Smartwatch such as the Apple Watch, Authy[1] is a pretty rock solid option. I use Authy for a few key credentials, and I have used my watch for the keys. FYI, Authy was bought and is now owned by Twilio 1. https://authy.com
There's also Step Two, for iOS, Watch OS and even macOS. I quite like it.
That's what I use as well. Nice apps, fair pricing (One-time payment) and no data collection.
Started using it only because of its feature to sync between devices with iCloud - so no more stress if my phone breaks.
Re: TOTP tokens on my wrist with the smartest dumb watch
#54Is there some Unix-ish tool to generate these TOTPs on a laptop? I don't like to keep the 2nd factor on a small mobile device that is easy to lose. So I ask about a laptop tool. By Unix-ish I mean something that is small and does one thing well. Like pipe in a secret to it and it gives me a TOTP? Pipe in multiple secrets and it gives me multiple TOTPs? Then I don't have to remain beholden to a custom encryption forma…
Several options...
Not exactly the same, but if you're using Bitwarden (which is compatible with generating TOTP tokens) to manage your passwords, you can use their bitwarden-cli tool to request tokens from the cli: https://bitwarden.com/help/cli/#get
But if you want the simplest cli thing, you can probably can use this golang ( https://github.com/yitsushi/totp-cli ) or this python ( https://github.com/WhyNotHugo/totp-cli ) implementations.
Re: TOTP tokens on my wrist with the smartest dumb watch
#55Cool hack. That said: A security reminder to anyone who is in the target audience here: if you're clever enough to have TOTP 2FA enabled on your Google account, get some cheap USB security keys and enable Advanced Protection, which completely disables non-hardware 2FA. It requires two different tokens (and you should really get one for each computer you have/use, plus at least one offsite backup) because once enabled…
While I agree with your points regarding the security of TOTP / SMS, and I do push for hardware keys at work, I think a case could be made for a mixed use for "regular people". Maintaining two hardware keys is an absolute PITA, especially if you go down the route of storing one off-site, hence not having it with you to enroll when you get a new account. What I do, is use the hardware token as the "main" factor and us…
This needs to be repeated too. And developers need to be reminded that anything they secure with hardware keys absolutely needs to accept multiple hardware keys in order to mitigate loss or destruction of the first key.
Re: TOTP tokens on my wrist with the smartest dumb watch
#56Is there some Unix-ish tool to generate these TOTPs on a laptop? I don't like to keep the 2nd factor on a small mobile device that is easy to lose. So I ask about a laptop tool. By Unix-ish I mean something that is small and does one thing well. Like pipe in a secret to it and it gives me a TOTP? Pipe in multiple secrets and it gives me multiple TOTPs? Then I don't have to remain beholden to a custom encryption forma…
https://keepassxc.org comes with keepassxc-cli
Re: TOTP tokens on my wrist with the smartest dumb watch
#57[deleted]
Re: TOTP tokens on my wrist with the smartest dumb watch
#58If you're a bit weirded out by the website secret pasting, I made a PR which lets the sensor watch load TOTP secrets from an Aegis export (essentially just a bunch of TOTP URIs):
https://github.com/joeycastillo/Sensor-Watch/pull/95
This is the reason I bought the board. It makes me happy not having to use my phone for this.
Re: TOTP tokens on my wrist with the smartest dumb watch
#59Earlier quoted context omitted.
AndOTP is great. Especially if you compare it with all the iOS options. iOS TOTP apps all suck, it's amazingly bad. I installed like ~15 different ones. After the fifth try, I just had to know if it was just my poor initial selection or a general problem. Each and every iOS TOTP app has at least one crucial problem - requiring a subscription, mandatory sync to a proprietary cloud, having no export-import, not having…
iOS's security makes a self-hosted/non-third party backup/sync super difficult IIRC. (Unless you use Apple's product) I think unless the app has it built in, it's not easily doable. Android can use syncthing, but even Google is making that more and more difficult with each release. Is there a standard app developers can use to securely sync/backup to for self-hosters? Is there a 'nice' UX/flow to connect apps to s3-s…
You're most likely correct about automatic synchronisation from filesystem like that. That though doesn't mean there can't be any built-in integration with Next/OwnCloud or simply manual export-import.
Re: TOTP tokens on my wrist with the smartest dumb watch
#60Earlier quoted context omitted.
I use AndOTP on Android. You can export to a PGP-encrypted JSON file so your keys are really your own and not locked into a walled garden like Authy.
AndOTP is great. Especially if you compare it with all the iOS options. iOS TOTP apps all suck, it's amazingly bad. I installed like ~15 different ones. After the fifth try, I just had to know if it was just my poor initial selection or a general problem. Each and every iOS TOTP app has at least one crucial problem - requiring a subscription, mandatory sync to a proprietary cloud, having no export-import, not having…
Did you try Ravio OTP? I've seen good things said about it by FOSS people.