Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TOTP tokens on my wrist with the smartest dumb watch

blog.singleton.io

Post reply on HN
Print view View original

121–130 of 131 posts

Re: TOTP tokens on my wrist with the smartest dumb watch

#121

Post by andrepd »

wlesieutre wrote: post #118
andrepd wrote: post #93

Earlier quoted context omitted.

One of my long-term hacker project goals is to replace the guts of an analog watch with a microcontroller and turn it into a "smartwatch-lite". There's a surprising amount of information and features you can display with three pointers (and a small numeric window): temperature, heartrate and other body sensors, NFC to replace payment or access cards, etc.

Not as customizable as what I'm sure you're planning, but Withings makes watches with that design direction https://www.withings.com/us/en/watches

Yep there are plenty of watches like that (for example Fossil I think), but I'd really like to take a nice vintage watch and build a hackable watch platform myself.

Re: TOTP tokens on my wrist with the smartest dumb watch

#122

Post by yunruse »

The concept of programming a dumb watch is rather appealing; this project looks like one that's both practical and quite fun to work on.

It would be rather neat to have a dumb watch that can take in custom embedded code (say Lua) for people who enjoy hacking but are terrible at hardware. I'd buy one day one!

Re: TOTP tokens on my wrist with the smartest dumb watch

#124

Post by jkepler »

wlesieutre wrote: post #118
andrepd wrote: post #93

Earlier quoted context omitted.

One of my long-term hacker project goals is to replace the guts of an analog watch with a microcontroller and turn it into a "smartwatch-lite". There's a surprising amount of information and features you can display with three pointers (and a small numeric window): temperature, heartrate and other body sensors, NFC to replace payment or access cards, etc.

Not as customizable as what I'm sure you're planning, but Withings makes watches with that design direction https://www.withings.com/us/en/watches

Yeah, I had a Withings semismart watch, one of their cheaper models without a screen. It integrated a pedometer, and had a dial had that would show steps taken, it moved from 0 to 100% of your goal. One had to pair it to the Withings Android app to set not just the goal for number of steps/day, but even for setting the time.

I sold it after a few months, realizing how much I missed a second hand and a glow-in-the-dark face. Also, the app had a ton of telemetry going back to Withings.

Building your own you would be in full control of the data.

Re: TOTP tokens on my wrist with the smartest dumb watch

#125

Post by [deleted] »

distcs wrote: post #50

Is there some Unix-ish tool to generate these TOTPs on a laptop? I don't like to keep the 2nd factor on a small mobile device that is easy to lose. So I ask about a laptop tool. By Unix-ish I mean something that is small and does one thing well. Like pipe in a secret to it and it gives me a TOTP? Pipe in multiple secrets and it gives me multiple TOTPs? Then I don't have to remain beholden to a custom encryption forma…

[deleted]

Re: TOTP tokens on my wrist with the smartest dumb watch

#126

Post by austinjp »

distcs wrote: post #50

Is there some Unix-ish tool to generate these TOTPs on a laptop? I don't like to keep the 2nd factor on a small mobile device that is easy to lose. So I ask about a laptop tool. By Unix-ish I mean something that is small and does one thing well. Like pipe in a secret to it and it gives me a TOTP? Pipe in multiple secrets and it gives me multiple TOTPs? Then I don't have to remain beholden to a custom encryption forma…

I use https://github.com/pcarrier/gauth

It relies on file permissions so is not exactly robustly secure (no idea about RAM vulnerabilities etc).

As per the author, I consider my laptop the fundamental point of vulnerability. If someone else gets access to it, I'll know and I'll hit the metaphorical panic button :)

Edit: I recently set up a new laptop, and copied my OTP seeds from Aegis into gauth without a hitch. Another step closer to me moving away from Authy.

Re: TOTP tokens on my wrist with the smartest dumb watch

#127

Post by account42 »

VTimofeenko wrote: post #15
yellow_lead wrote: post #7

How accurate does the time have to be for TOTP to work? If the watch drifts a bit, will it no longer work? Compared to your phone which is synced with an NTP server.

The key lifetime may be other than the default 30 seconds, and IIRC the validator side may be configured to accept keys from N previous generations.

I wish all implementations would at least accept one previous generation. It sucks having to either wait for the next code or try to input before the timeout if it is close.

Re: TOTP tokens on my wrist with the smartest dumb watch

#128

Post by account42 »

UncleMeat wrote: post #104
tzs wrote: post #101

Earlier quoted context omitted.

> TOTP is not much better than SMS-based 2FA. It's still vulnerable to phishing, local device malware (that attacks your TOTP in your password manager), etc. It's still massively better than SMS-bases 2FA. Those vulnerabilities you list are all things that involve you or your device. You can take care to avoid them. With SMS there are also vulnerabilities that don't involve you or your device, such as someone convinc…

SIM swap is real but rare, since it cannot be automated. It is also largely defeated by having a strong and unique password, assuming that your provider doesn’t use SMS as a single factor password reset option. If you’ve got a strong and unique password then your primary concern should be phishing, which is the same for sms and totp.

> assuming that your provider doesn’t use SMS as a single factor password reset option.

That's a big assumption and one that is far from generally true.

Re: TOTP tokens on my wrist with the smartest dumb watch

#129

Post by pabs3 »

aw1cks wrote: post #73
distcs wrote: post #50

Is there some Unix-ish tool to generate these TOTPs on a laptop? I don't like to keep the 2nd factor on a small mobile device that is easy to lose. So I ask about a laptop tool. By Unix-ish I mean something that is small and does one thing well. Like pipe in a secret to it and it gives me a TOTP? Pipe in multiple secrets and it gives me multiple TOTPs? Then I don't have to remain beholden to a custom encryption forma…

pass-otp[0] integrates into pass[1] nicely. It's about as unix-y as password/secret management comes in my eyes. Alternatively, gopass[2], which re-implements pass in golang, has this functionality built in[3]. [0] https://github.com/tadfisher/pass-otp [1] https://www.passwordstore.org/ [2] https://www.gopass.pw/ [3] https://github.com/gopasspw/gopass/blob/master/docs/commands...

Also use browserpass to integrate pass with Firefox/etc:

https://github.com/browserpass/

Re: TOTP tokens on my wrist with the smartest dumb watch

#130

Post by lesuorac »

account42 wrote: post #127
VTimofeenko wrote: post #15

Earlier quoted context omitted.

The key lifetime may be other than the default 30 seconds, and IIRC the validator side may be configured to accept keys from N previous generations.

I wish all implementations would at least accept one previous generation. It sucks having to either wait for the next code or try to input before the timeout if it is close.

I'm not sure I've ran into an implementation that doesn't.

I used to wait for the code to rollover before entering it but honestly if you're not sure if the implementation accepts a previous code or now just use that time to try it and if it fails you still have like 45s to enter the current code.

Post reply on HN