Damn the font size is way too large on my mobile, unreadable.
TOTP tokens on my wrist with the smartest dumb watch
111–120 of 131 posts
Re: TOTP tokens on my wrist with the smartest dumb watch
#112Is there some Unix-ish tool to generate these TOTPs on a laptop? I don't like to keep the 2nd factor on a small mobile device that is easy to lose. So I ask about a laptop tool. By Unix-ish I mean something that is small and does one thing well. Like pipe in a secret to it and it gives me a TOTP? Pipe in multiple secrets and it gives me multiple TOTPs? Then I don't have to remain beholden to a custom encryption forma…
pass-otp[0] integrates into pass[1] nicely. It's about as unix-y as password/secret management comes in my eyes. Alternatively, gopass[2], which re-implements pass in golang, has this functionality built in[3]. [0] https://github.com/tadfisher/pass-otp [1] https://www.passwordstore.org/ [2] https://www.gopass.pw/ [3] https://github.com/gopasspw/gopass/blob/master/docs/commands...
Thanks for the compliment!
Re: TOTP tokens on my wrist with the smartest dumb watch
#113Re: TOTP tokens on my wrist with the smartest dumb watch
#114What's old is new once again. It's the old RSA SecurID token generator, but now it has water-resistance and an LED! I'll buy one.
Re: TOTP tokens on my wrist with the smartest dumb watch
#115I didn't see anything on the site about where to get one, so here's the link to their crowd supply, 36$ for the board.
https://www.crowdsupply.com/oddly-specific-objects/sensor-wa...
Re: TOTP tokens on my wrist with the smartest dumb watch
#116This is super cool but do folks really need their google and GitHub 2FA codes often enough to justify this? Browser sessions are pretty durable it seems. The one thing I could think of is GitHub admin type actions that prompt for a credential to enter “sudo” mode or whatever they call it. However in that case they’ll take your password as well (or a webauthn key in my case)
Some folks don't use browser sessions.
I log out of everything every day.
Re: TOTP tokens on my wrist with the smartest dumb watch
#117Earlier quoted context omitted.
I use AndOTP on Android. You can export to a PGP-encrypted JSON file so your keys are really your own and not locked into a walled garden like Authy.
AndOTP is great. Especially if you compare it with all the iOS options. iOS TOTP apps all suck, it's amazingly bad. I installed like ~15 different ones. After the fifth try, I just had to know if it was just my poor initial selection or a general problem. Each and every iOS TOTP app has at least one crucial problem - requiring a subscription, mandatory sync to a proprietary cloud, having no export-import, not having…
I have been using OTP Auth for a while. It doesn't get updated a lot but it's working fine.
Re: TOTP tokens on my wrist with the smartest dumb watch
#118I just wanted to call out how cool it is to replace the guts of a 1980s-era wristwatch with a ARM Cortex M0+ microcontroller, while reusing the original display and buttons.
One of my long-term hacker project goals is to replace the guts of an analog watch with a microcontroller and turn it into a "smartwatch-lite". There's a surprising amount of information and features you can display with three pointers (and a small numeric window): temperature, heartrate and other body sensors, NFC to replace payment or access cards, etc.
Not as customizable as what I'm sure you're planning, but Withings makes watches with that design direction
Re: TOTP tokens on my wrist with the smartest dumb watch
#119Earlier quoted context omitted.
I have everything in 1P. No need for a physical device.
I always thought that the benefit of the physical device was that it was decoupled from the main device. If someone steals my laptop, for example, they won't be able to access my MFA secured accounts unless they ALSO steal my phone (and are unable to lock it).
Sure, but if your threat model is that the attacker has enough access to your machine to extract your password manager's database, they can also just copy your session cookies from your existing browser session. Even in the case of password leaks, if someone breaches the password database of a website they can just as easily dump the TOTP table.
Personally my view is that (if you're using a password manager with a unique password per-site) 2FA primarily protects you when you have to input your password on an untrusted system that may have a keylogger. In that case it doesn't really matter where you store the TOTP key (presumably you're not going to unlock your password database on that machine).
To be fair, in the case of a security bug in the password manager (such as the few previous LastPass bugs in this vein), you are slightly more protected. But I use KeePassXC which has a far more segregated design so I'm not as worried about this as I would be if I was using a password manager entirely integrated into the browser (either built-in or an extension).
(Though these days I primarily use U2F/WebAuthn if the site supports it.)
Re: TOTP tokens on my wrist with the smartest dumb watch
#120This is super cool but do folks really need their google and GitHub 2FA codes often enough to justify this? Browser sessions are pretty durable it seems. The one thing I could think of is GitHub admin type actions that prompt for a credential to enter “sudo” mode or whatever they call it. However in that case they’ll take your password as well (or a webauthn key in my case)
Also, some sites, such as Fidelity, now require the 2fa password on every login regardless of browser trust status.