Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TOTP tokens on my wrist with the smartest dumb watch

blog.singleton.io

Post reply on HN
Print view View original

61–70 of 131 posts

Re: TOTP tokens on my wrist with the smartest dumb watch

#61

Post by ceejayoz »

stoplying1 wrote: post #48
ceejayoz wrote: post #43

Earlier quoted context omitted.

The phone number gets used during account recovery; when I reset my iPhone once without a second Authy device to activate it, I was locked out for 24h while it bombarded my number with calls and texts about the impending restore. I appreciated that safety measure.

And I don't appreciate being forced into a "feature" that specifically subverts the entire god damn point of 2FA codes and leaves them in an unprotected state on some third party server. Great!

It is, indeed, great to have choices.

(Side note: Authy backups are encrypted client-side with the user's backup password. They're not unprotected on a third-party server; Authy has no ability to decrypt them. https://authy.com/blog/how-the-authy-two-factor-backups-work...)

Re: TOTP tokens on my wrist with the smartest dumb watch

#62

Post by wryun »

Tepix wrote: post #36

Neat. For those who don't want to tinker with hardware (just software) - is there a nice app providing TOTP for the PineTime smartwatch?

It is pretty trivial to put this board in a Casio watch; I'm not even sure I'd call it tinkering unless you decided you want to connect the buzzer (requires soldering one bit of metal).

Re: TOTP tokens on my wrist with the smartest dumb watch

#63

Post by Avamander »

whatsthatabout wrote: post #53
dontlaugh wrote: post #46

Earlier quoted context omitted.

There's also Step Two, for iOS, Watch OS and even macOS. I quite like it.

That's what I use as well. Nice apps, fair pricing (One-time payment) and no data collection. Started using it only because of its feature to sync between devices with iCloud - so no more stress if my phone breaks.

Unfortunately it has no import/export functionality and truncates eight/ten-digit TOTP codes. As I mentioned in an another comment, even then it is better than most alternatives on iOS.

Re: TOTP tokens on my wrist with the smartest dumb watch

#64

Post by grenoire »

distcs wrote: post #50

Is there some Unix-ish tool to generate these TOTPs on a laptop? I don't like to keep the 2nd factor on a small mobile device that is easy to lose. So I ask about a laptop tool. By Unix-ish I mean something that is small and does one thing well. Like pipe in a secret to it and it gives me a TOTP? Pipe in multiple secrets and it gives me multiple TOTPs? Then I don't have to remain beholden to a custom encryption forma…

I just cooked up something in Python if you have it installed on your system, quite straightforward to use. If there's interest, I can prepare a compiled version.

Unlike the other ones posted here, this one just takes secrets as arguments:

    > python -mtotp DGLTPWEUERUUDCEC SWPKQCKEWRXPCRXE
    628502
    674329
https://pastebin.com/apNKxMBF

Re: TOTP tokens on my wrist with the smartest dumb watch

#65

Post by 3np »

distcs wrote: post #50

Is there some Unix-ish tool to generate these TOTPs on a laptop? I don't like to keep the 2nd factor on a small mobile device that is easy to lose. So I ask about a laptop tool. By Unix-ish I mean something that is small and does one thing well. Like pipe in a secret to it and it gives me a TOTP? Pipe in multiple secrets and it gives me multiple TOTPs? Then I don't have to remain beholden to a custom encryption forma…

Here's an example of how you can wrap oathtool from oath-toolkit: https://markusholtermann.eu/2018/08/simple-bash-totp-script/

https://www.nongnu.org/oath-toolkit/

Re: TOTP tokens on my wrist with the smartest dumb watch

#66

Post by maeln »

distcs wrote: post #50

Is there some Unix-ish tool to generate these TOTPs on a laptop? I don't like to keep the 2nd factor on a small mobile device that is easy to lose. So I ask about a laptop tool. By Unix-ish I mean something that is small and does one thing well. Like pipe in a secret to it and it gives me a TOTP? Pipe in multiple secrets and it gives me multiple TOTPs? Then I don't have to remain beholden to a custom encryption forma…

> Is there some Unix-ish tool to generate these TOTPs on a laptop? I don't like to keep the 2nd factor on a small mobile device that is easy to lose.

I know that this is not really answering your question, but most open-source TOTP apps (like andOTP and Aegis) can export all the TOTP in an encrypted file that you can save. So if you lose your main TOTP device you can restore all of them quite easily.

Re: TOTP tokens on my wrist with the smartest dumb watch

#67

Post by bjord »

stoplying1 wrote: post #49
Avamander wrote: post #44

Earlier quoted context omitted.

Are those backups E2EE? Also to be totally honest, each device should have their own TOTP key and while backups are fine*, key sharing isn't.

No. They aren't. This thread is seriously upsetting to read. So many people clearly haven't even remotely begun to think about what they're doing or the implications thereof.

everything I've read suggests that they are, in fact, E2EE

of course, they're not open source, so I'm not really going to bat for them here, but am I missing something?

https://authy.com/blog/how-the-authy-two-factor-backups-work...

https://www.ghacks.net/2022/08/10/twilio-the-company-behind-...

etc.

Re: TOTP tokens on my wrist with the smartest dumb watch

#68

Post by Avamander »

Caboose8685 wrote: post #60
Avamander wrote: post #45

Earlier quoted context omitted.

AndOTP is great. Especially if you compare it with all the iOS options. iOS TOTP apps all suck, it's amazingly bad. I installed like ~15 different ones. After the fifth try, I just had to know if it was just my poor initial selection or a general problem. Each and every iOS TOTP app has at least one crucial problem - requiring a subscription, mandatory sync to a proprietary cloud, having no export-import, not having…

Did you try Ravio OTP? I've seen good things said about it by FOSS people. https://raivo-otp.com/

Yes. It had no import functionality, no Apple Watch companion, and a relatively convoluted setup process that adds a point of failure without reasonable reduction in any risk.

One would have to set a password that they then store in a password manager, that is then accessed using the same 2FA protected by the password. Plus a mandatory PIN, with the same caveats. Cyclical or duplicate authentication is simply not good design.

Re: TOTP tokens on my wrist with the smartest dumb watch

#69

Post by susam »

grenoire wrote: post #64
distcs wrote: post #50

Is there some Unix-ish tool to generate these TOTPs on a laptop? I don't like to keep the 2nd factor on a small mobile device that is easy to lose. So I ask about a laptop tool. By Unix-ish I mean something that is small and does one thing well. Like pipe in a secret to it and it gives me a TOTP? Pipe in multiple secrets and it gives me multiple TOTPs? Then I don't have to remain beholden to a custom encryption forma…

I just cooked up something in Python if you have it installed on your system, quite straightforward to use. If there's interest, I can prepare a compiled version. Unlike the other ones posted here, this one just takes secrets as arguments: > python -mtotp DGLTPWEUERUUDCEC SWPKQCKEWRXPCRXE 628502 674329 https://pastebin.com/apNKxMBF

I believe it is worth mentioning here that reading secrets from command line arguments exposes the secrets in shell history (e.g., ~/.bash_history, ~/.zsh_history, etc.), thus writing the secrets in cleartext to the filesystem. If command line auditing is enabled on a system, any secrets in command line arguments would be exposed in such audit logs too.

Further, if multiple users are logged into the same system (perhaps an unlikely scenario for most people), then secrets in command line arguments would expose the secrets in the output of ps -ef too thereby exposing the secrets to other users.

By the way, I have a similar script at https://github.com/susam/mintotp but it reads secrets from the standard input (as opposed to reading from command line arguments), one secret per line, and outputs TOTP values, one per line. Most of what this script does can be done with oathtool too and there is a section titled "Alternative: OATH Toolkit" in the README that documents this in detail.

Re: TOTP tokens on my wrist with the smartest dumb watch

#70

Post by undume »

distcs wrote: post #50

Is there some Unix-ish tool to generate these TOTPs on a laptop? I don't like to keep the 2nd factor on a small mobile device that is easy to lose. So I ask about a laptop tool. By Unix-ish I mean something that is small and does one thing well. Like pipe in a secret to it and it gives me a TOTP? Pipe in multiple secrets and it gives me multiple TOTPs? Then I don't have to remain beholden to a custom encryption forma…

OATH Tookit provides console tool for generating TOTP codes: oathtool. https://www.nongnu.org/oath-toolkit/
Post reply on HN