Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TOTP tokens on my wrist with the smartest dumb watch

blog.singleton.io

Post reply on HN
Print view View original

101–110 of 131 posts

Re: TOTP tokens on my wrist with the smartest dumb watch

#101

Post by tzs »

sneak wrote: post #2

Cool hack. That said: A security reminder to anyone who is in the target audience here: if you're clever enough to have TOTP 2FA enabled on your Google account, get some cheap USB security keys and enable Advanced Protection, which completely disables non-hardware 2FA. It requires two different tokens (and you should really get one for each computer you have/use, plus at least one offsite backup) because once enabled…

> TOTP is not much better than SMS-based 2FA. It's still vulnerable to phishing, local device malware (that attacks your TOTP in your password manager), etc.

It's still massively better than SMS-bases 2FA. Those vulnerabilities you list are all things that involve you or your device. You can take care to avoid them.

With SMS there are also vulnerabilities that don't involve you or your device, such as someone convincing your carrier to transfer your phone number to them.

Re: TOTP tokens on my wrist with the smartest dumb watch

#102

Post by m-p-3 »

samcat116 wrote: post #98

This is super cool but do folks really need their google and GitHub 2FA codes often enough to justify this? Browser sessions are pretty durable it seems. The one thing I could think of is GitHub admin type actions that prompt for a credential to enter “sudo” mode or whatever they call it. However in that case they’ll take your password as well (or a webauthn key in my case)

It saved me a trip back to my desk a few times when I had to sign in to an account protected by 2FA on another computer and I forgot to bring my phone along.

Re: TOTP tokens on my wrist with the smartest dumb watch

#103

Post by neilv »

susam wrote: post #69
grenoire wrote: post #64

Earlier quoted context omitted.

I just cooked up something in Python if you have it installed on your system, quite straightforward to use. If there's interest, I can prepare a compiled version. Unlike the other ones posted here, this one just takes secrets as arguments: > python -mtotp DGLTPWEUERUUDCEC SWPKQCKEWRXPCRXE 628502 674329 https://pastebin.com/apNKxMBF

I believe it is worth mentioning here that reading secrets from command line arguments exposes the secrets in shell history (e.g., ~/.bash_history, ~/.zsh_history, etc.), thus writing the secrets in cleartext to the filesystem. If command line auditing is enabled on a system, any secrets in command line arguments would be exposed in such audit logs too. Further, if multiple users are logged into the same system (perh…

> reading secrets from command line arguments exposes the secrets in shell history

Yes, and process arguments (such as from command line) can also be accessible in process list data that's accessible to other processes and users.

Even if the process only lives for an instant, or normally no other processes could access the data, good practice is to nevertheless keep secrets out of any process arguments.

Re: TOTP tokens on my wrist with the smartest dumb watch

#104

Post by UncleMeat »

tzs wrote: post #101
sneak wrote: post #2

Cool hack. That said: A security reminder to anyone who is in the target audience here: if you're clever enough to have TOTP 2FA enabled on your Google account, get some cheap USB security keys and enable Advanced Protection, which completely disables non-hardware 2FA. It requires two different tokens (and you should really get one for each computer you have/use, plus at least one offsite backup) because once enabled…

> TOTP is not much better than SMS-based 2FA. It's still vulnerable to phishing, local device malware (that attacks your TOTP in your password manager), etc. It's still massively better than SMS-bases 2FA. Those vulnerabilities you list are all things that involve you or your device. You can take care to avoid them. With SMS there are also vulnerabilities that don't involve you or your device, such as someone convinc…

SIM swap is real but rare, since it cannot be automated. It is also largely defeated by having a strong and unique password, assuming that your provider doesn’t use SMS as a single factor password reset option.

If you’ve got a strong and unique password then your primary concern should be phishing, which is the same for sms and totp.

Re: TOTP tokens on my wrist with the smartest dumb watch

#105

Post by teaearlgraycold »

samcat116 wrote: post #98

This is super cool but do folks really need their google and GitHub 2FA codes often enough to justify this? Browser sessions are pretty durable it seems. The one thing I could think of is GitHub admin type actions that prompt for a credential to enter “sudo” mode or whatever they call it. However in that case they’ll take your password as well (or a webauthn key in my case)

I have everything in 1P. No need for a physical device.

Re: TOTP tokens on my wrist with the smartest dumb watch

#106

Post by cryptonector »

lukeschlather wrote: post #83
distcs wrote: post #50

Is there some Unix-ish tool to generate these TOTPs on a laptop? I don't like to keep the 2nd factor on a small mobile device that is easy to lose. So I ask about a laptop tool. By Unix-ish I mean something that is small and does one thing well. Like pipe in a secret to it and it gives me a TOTP? Pipe in multiple secrets and it gives me multiple TOTPs? Then I don't have to remain beholden to a custom encryption forma…

You need a TPM 2.0 compatible CPU, but something like this sounds really excellent: https://github.com/tpm2-software/tpm2-totp This means your laptop itself would be your hardware device, the TOTP secret would be stored in the TPM and theoretically impossible to steal/copy. Of course this means you will probably want a mobile device (possibly a second laptop also) as a backup.)

Note that tpm2-totp is specifically meant to authenticate your laptop's state (TPM PCR values) to you, not you to some third system. But you could adapt tpm2-totp for the purpose of authenticating you to other systems.

Re: TOTP tokens on my wrist with the smartest dumb watch

#107

Post by bdcravens »

samcat116 wrote: post #98

This is super cool but do folks really need their google and GitHub 2FA codes often enough to justify this? Browser sessions are pretty durable it seems. The one thing I could think of is GitHub admin type actions that prompt for a credential to enter “sudo” mode or whatever they call it. However in that case they’ll take your password as well (or a webauthn key in my case)

Some sites prompt more frequently (for example, AWS)

Re: TOTP tokens on my wrist with the smartest dumb watch

#108

Post by MartinCron »

teaearlgraycold wrote: post #105
samcat116 wrote: post #98

This is super cool but do folks really need their google and GitHub 2FA codes often enough to justify this? Browser sessions are pretty durable it seems. The one thing I could think of is GitHub admin type actions that prompt for a credential to enter “sudo” mode or whatever they call it. However in that case they’ll take your password as well (or a webauthn key in my case)

I have everything in 1P. No need for a physical device.

I always thought that the benefit of the physical device was that it was decoupled from the main device. If someone steals my laptop, for example, they won't be able to access my MFA secured accounts unless they ALSO steal my phone (and are unable to lock it).

Re: TOTP tokens on my wrist with the smartest dumb watch

#109

Post by tejado »

kamranjon wrote: post #92

This is very cool, I just recently ordered a light phone 2 (a dumb phone) - and one of the things I am currently trying to solve is how I am going to access my google authentication codes for various work and personal project related accounts. Something like this would be very awesome, but also this post really demystifies how this type of auth works.

Maybe Authorizer is something you will like: https://github.com/tejado/Authorizer

Re: TOTP tokens on my wrist with the smartest dumb watch

#110

Post by monocasa »

cyanawesome wrote: post #86
mkesper wrote: post #34

Please do not paste your secrets into any website as proposed here for conversion.

Seriously, the QR is just a URI that any QR reader can decode (preferably one you trust). https://github.com/google/google-authenticator/wiki/Key-Uri-...

And not just that, but TOTP isn't based on public/private crypto, but instead a shared secret embedded in plaintext in that URI.
Post reply on HN