Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

De-Googling TOTP Authenticator Codes

imrannazar.com

Post reply on HN
Print view View original

111–120 of 138 posts

Re: De-Googling TOTP Authenticator Codes

#111

Post by brookst »

Aachen wrote: post #39
quchen wrote: post #26

Earlier quoted context omitted.

The second factor does not have to be a second device . Like everything security, it’s what you’re protecting against. Shoulder surfing and device theft are not something I worry about in my home setup, for example.

> The second factor does not have to be a second device. Like everything security, it’s what you’re protecting against. It doesn't matter if you store your 2FA seed on a billboard or as a tattoo where the sun doesn't shine: 2FA means two factors. The definition doesn't change when your home setup's threat model doesn't call for 2FA and you thus decide to store two secrets in the same place (making a compromise of one…

This is so wrong. You’re conflating where things are with what they are. Two factors does not mean two devices.

Re: De-Googling TOTP Authenticator Codes

#112

Post by Marsymars »

nicoburns wrote: post #87
Aachen wrote: post #13

To be clear, the point of storing a secret token on your phone and then typing over some codes that prove you have access to the secret still, is to provide 2FA. If you use oathtool on your laptop, and the password is stored there as well, you're back to 1FA That can be fine if that's what you want, but if you wanted 2FA: - FreeOTP: https://f-droid.org/packages/org.fedorahosted.freeotp - someone forked that and calle…

> If you use oathtool on your laptop, and the password is stored there as well, you're back to 1FA... that can be fine if that's what you want. A lot of the time that is what I want. 2FA is pretty overkill for low-importance accounts if you're using a long random password anyway. But some services make it mandatory.

I quite like TOTP for this reason - it's much less annoying to autofill TOTP than to retrieve a one-time code from SMS or email.

Re: De-Googling TOTP Authenticator Codes

#113

Post by ori_b »

dngray wrote: post #107
ori_b wrote: post #88

Earlier quoted context omitted.

If you log into accounts from your phone, that's also 1fa in the same way. And if you keep your phone in the same place as your laptop, so it can get stolen at the same time, that's also effectively 1fa. The threats that TOTP protects against are ones that don't involve losing your device. For example, if somebody breaches a password database or phishes your password, TOTP codes prevent them from using the leaked cre…

> If you log into accounts from your phone, that's also 1fa in the same way. Not quite, there's a lot more sandboxing on phones than what might go on with desktop.

That sandboxing doesn't help if your phone gets stolen.

Re: De-Googling TOTP Authenticator Codes

#114

Post by plumeria »

chaz6 wrote: post #76

I have said time and time again, keep a copy of the QR code (or the text encoded within) before adding it to an authenticator app. You may find out too late that you cannot recover the keys. You can do this by simply taking a photo or screenshot of the QR code and storing it in a safe place. Even better, avoid any MFA mechanism that relies on short codes with low entropy. Instead you could use U2F which uses a hardwa…

This is the nice thing about keeping it in Keepass XC. The seed is saved as an attribute in the database, you can easily add it to another app if needed.

Re: De-Googling TOTP Authenticator Codes

#115

Post by lokar »

Marsymars wrote: post #109
lokar wrote: post #94

Earlier quoted context omitted.

If you have a Mac, what about using keychain? It has a cli/api and is protected by the Secure Enclave (so 2nd factor to unlock that)

> Secure Enclave (so 2nd factor to unlock that) How so?

You need the fingerprint sensor to unlock it

Re: De-Googling TOTP Authenticator Codes

#116

Post by bkettle »

ori_b wrote: post #88
Aachen wrote: post #13

To be clear, the point of storing a secret token on your phone and then typing over some codes that prove you have access to the secret still, is to provide 2FA. If you use oathtool on your laptop, and the password is stored there as well, you're back to 1FA That can be fine if that's what you want, but if you wanted 2FA: - FreeOTP: https://f-droid.org/packages/org.fedorahosted.freeotp - someone forked that and calle…

If you log into accounts from your phone, that's also 1fa in the same way. And if you keep your phone in the same place as your laptop, so it can get stolen at the same time, that's also effectively 1fa. The threats that TOTP protects against are ones that don't involve losing your device. For example, if somebody breaches a password database or phishes your password, TOTP codes prevent them from using the leaked cre…

It depends on the phone, but for many phones the security story remains very good even when lost, unless someone knows your passcode. So it’s still “something you know” protecting the password and the TOTP code, but it’s different things that you know and strict rate-limiting on the phone side that wouldn’t be possible on an internet-exposed authentication system makes it extremely difficult to guess the phone passcode.

Re: De-Googling TOTP Authenticator Codes

#117

Post by bkettle »

8cvor6j844qw_d6 wrote: post #50
tremon wrote: post #34

Earlier quoted context omitted.

the password and the "2FA" seed token are both the same type of secret string This is a category error. The 2FA seed token may be a string of bytes just like the password, but the seed is never communicated outside your device. That makes them different types of secrets: a capture of the transmitted login codes will not compromise the 2FA seed. Even if you auto-generate the password in the same way, it's the actual v…

Symmetric as another poster mentioned. With some margin for connection delays (e.g., server checks 3 codes (1 forward and 1 backward) for a total of 90 seconds) [1]. I'll be interested in a asymmetric variant although I'll probably use a popular library and call it a day if I have to get involved in 2FA. [1]: https://auth0.com/blog/the-working-principles-of-2fa-2-facto...

Do we have the crypto to build an asymmetric variant? The way that I’d immediately think to do it is have the authenticator create a signature over the current time (chunked into 30-second windows) and the service verify that signature, but obviously those signature texts are way too long to manually enter as a one-time code. (Symmetric) TOTP solves this length problem by just truncating the output of a hash function, which both the authenticator and the service can produce because they have a shared secret. But in the signature case the service would need the entire signature to validate it; any truncation would make it useless.

It’s been a while since I did any crypto. But it feels like the shortness of the one-time-code probably makes it impossible to do asymmetrically. If this is indeed the case there is probably an elegant proof or some better way of thinking about why it’s impossible. I would be interested in reading that.

Re: De-Googling TOTP Authenticator Codes

#118

Post by sjs382 »

Aachen wrote: post #13

To be clear, the point of storing a secret token on your phone and then typing over some codes that prove you have access to the secret still, is to provide 2FA. If you use oathtool on your laptop, and the password is stored there as well, you're back to 1FA That can be fine if that's what you want, but if you wanted 2FA: - FreeOTP: https://f-droid.org/packages/org.fedorahosted.freeotp - someone forked that and calle…

What you describe in the first paragraph isn't 1FA. There's still two factors—its just on one device.

You're conflating "factors" and devices.

Re: De-Googling TOTP Authenticator Codes

#119

Post by tripdout »

> The tool outputs the current date and time, so you can double-check that your code won't expire (at :00 seconds) before you get a chance to type it in

A lot of TOTP verifiers often check within ±1 time interval, so you can often just use the first code you see, no need e.g. to wait for it to roll over.

Re: De-Googling TOTP Authenticator Codes

#120

Post by NaomiLehman »

ezst wrote: post #31

Some time ago I realised how vulnerable I was keeping all my TOTPs in Authenticator __only__, in the event of losing/breaking my device (and no, there is no way I would sync them to Google cloud). This taught me few things: - there isn't much to Authenticator and TOTPs in general, it's just a secret, which can be shared across multiple TOTP managers and devices. I had solved the "single point of failure" concern - th…

Yubikeys support Google and other TOTPs too
Post reply on HN