TOTP tokens on my wrist with the smartest dumb watch • Hacker News Board

Re: TOTP tokens on my wrist with the smartest dumb watch

#81

Post by computerfriend » Tue, Oct 18, 2022, 12:44 PM UTC

distcs wrote: post #50

Is there some Unix-ish tool to generate these TOTPs on a laptop? I don't like to keep the 2nd factor on a small mobile device that is easy to lose. So I ask about a laptop tool. By Unix-ish I mean something that is small and does one thing well. Like pipe in a secret to it and it gives me a TOTP? Pipe in multiple secrets and it gives me multiple TOTPs? Then I don't have to remain beholden to a custom encryption forma…

You can also store them on YubiKeys, accessible on the command line with ykman.

Re: TOTP tokens on my wrist with the smartest dumb watch

#82

Post by nashashmi » Tue, Oct 18, 2022, 12:45 PM UTC

aw1cks wrote: post #73

distcs wrote: post #50

Is there some Unix-ish tool to generate these TOTPs on a laptop? I don't like to keep the 2nd factor on a small mobile device that is easy to lose. So I ask about a laptop tool. By Unix-ish I mean something that is small and does one thing well. Like pipe in a secret to it and it gives me a TOTP? Pipe in multiple secrets and it gives me multiple TOTPs? Then I don't have to remain beholden to a custom encryption forma…

pass-otp[0] integrates into pass[1] nicely. It's about as unix-y as password/secret management comes in my eyes. Alternatively, gopass[2], which re-implements pass in golang, has this functionality built in[3]. [0] https://github.com/tadfisher/pass-otp [1] https://www.passwordstore.org/ [2] https://www.gopass.pw/ [3] https://github.com/gopasspw/gopass/blob/master/docs/commands...

Also need to mention totp.app

It allows export import feature of keys

Re: TOTP tokens on my wrist with the smartest dumb watch

#83

Post by lukeschlather » Tue, Oct 18, 2022, 12:55 PM UTC

distcs wrote: post #50

Is there some Unix-ish tool to generate these TOTPs on a laptop? I don't like to keep the 2nd factor on a small mobile device that is easy to lose. So I ask about a laptop tool. By Unix-ish I mean something that is small and does one thing well. Like pipe in a secret to it and it gives me a TOTP? Pipe in multiple secrets and it gives me multiple TOTPs? Then I don't have to remain beholden to a custom encryption forma…

You need a TPM 2.0 compatible CPU, but something like this sounds really excellent: https://github.com/tpm2-software/tpm2-totp

This means your laptop itself would be your hardware device, the TOTP secret would be stored in the TPM and theoretically impossible to steal/copy. Of course this means you will probably want a mobile device (possibly a second laptop also) as a backup.)

Re: TOTP tokens on my wrist with the smartest dumb watch

#84

Post by cbm-vic-20 » Tue, Oct 18, 2022, 1:04 PM UTC

I just wanted to call out how cool it is to replace the guts of a 1980s-era wristwatch with a ARM Cortex M0+ microcontroller, while reusing the original display and buttons.

Re: TOTP tokens on my wrist with the smartest dumb watch

#85

Post by emreb » Tue, Oct 18, 2022, 1:16 PM UTC

distcs wrote: post #50

Is there some Unix-ish tool to generate these TOTPs on a laptop? I don't like to keep the 2nd factor on a small mobile device that is easy to lose. So I ask about a laptop tool. By Unix-ish I mean something that is small and does one thing well. Like pipe in a secret to it and it gives me a TOTP? Pipe in multiple secrets and it gives me multiple TOTPs? Then I don't have to remain beholden to a custom encryption forma…

Authy used to have a Chrome client you can run on your computer that syncronizes all your secrets.

Re: TOTP tokens on my wrist with the smartest dumb watch

#86

Post by cyanawesome » Tue, Oct 18, 2022, 1:36 PM UTC

mkesper wrote: post #34

Please do not paste your secrets into any website as proposed here for conversion.

Seriously, the QR is just a URI that any QR reader can decode (preferably one you trust).

https://github.com/google/google-authenticator/wiki/Key-Uri-...

Re: TOTP tokens on my wrist with the smartest dumb watch

#87

Post by markstos » Tue, Oct 18, 2022, 1:49 PM UTC

distcs wrote: post #50

Is there some Unix-ish tool to generate these TOTPs on a laptop? I don't like to keep the 2nd factor on a small mobile device that is easy to lose. So I ask about a laptop tool. By Unix-ish I mean something that is small and does one thing well. Like pipe in a secret to it and it gives me a TOTP? Pipe in multiple secrets and it gives me multiple TOTPs? Then I don't have to remain beholden to a custom encryption forma…

You are looking for a Yubikey and `ykman`.

This is secure because the secret never leaves the hardware key.

This is convenient because you launch a tool with a global keyboard shortcut and copy/paste the code. I use `yubikey-oath-dmenu` to allow me to quickly filter to the TOTP code I need.

Re: TOTP tokens on my wrist with the smartest dumb watch

#88

Post by stoplying1 » Tue, Oct 18, 2022, 1:54 PM UTC

ceejayoz wrote: post #61

stoplying1 wrote: post #48

Earlier quoted context omitted.

And I don't appreciate being forced into a "feature" that specifically subverts the entire god damn point of 2FA codes and leaves them in an unprotected state on some third party server. Great!

It is, indeed, great to have choices. (Side note: Authy backups are encrypted client-side with the user's backup password. They're not unprotected on a third-party server; Authy has no ability to decrypt them. https://authy.com/blog/how-the-authy-two-factor-backups-work... )

I apologize for getting that wrong and also want to acknowledge that choice IS good, and I do agree that informed users can reasonably make that decision. I get a bit too "there's one best/right answer" on this topic, thanks for checking me a bit.

Re: TOTP tokens on my wrist with the smartest dumb watch

#89

Post by stoplying1 » Tue, Oct 18, 2022, 1:55 PM UTC

stoplying1 wrote: post #49

Avamander wrote: post #44

Earlier quoted context omitted.

Are those backups E2EE? Also to be totally honest, each device should have their own TOTP key and while backups are fine*, key sharing isn't.

No. They aren't. This thread is seriously upsetting to read. So many people clearly haven't even remotely begun to think about what they're doing or the implications thereof.

Another user here pointed out that Authy uses a user provided password to encrypt the 2fa secrets on the server. That's definitely more secure than I had said, that's my mistake. (I still have my reservations, but that's getting too pedantic to matter here)

Re: TOTP tokens on my wrist with the smartest dumb watch

#90

Post by _dongle_aster_ » Tue, Oct 18, 2022, 1:57 PM UTC

stoplying1 wrote: post #48

ceejayoz wrote: post #43

Earlier quoted context omitted.

The phone number gets used during account recovery; when I reset my iPhone once without a second Authy device to activate it, I was locked out for 24h while it bombarded my number with calls and texts about the impending restore. I appreciated that safety measure.

And I don't appreciate being forced into a "feature" that specifically subverts the entire god damn point of 2FA codes and leaves them in an unprotected state on some third party server. Great!

The TOTP secrets are encrypted with a passprhase locally. You need the phone number to download the encrypted secrets but then need to use your passphrase to decrypt the restored backup locally.