[dead]
De-Googling TOTP Authenticator Codes
121–130 of 138 posts
Re: De-Googling TOTP Authenticator Codes
#122The worst offender in 2FA business is Steam, as it uses custom 2FA and you must install their app - no way to use 3rd party OTP without jumping through hoops and risking security.
At work we use OneLogin, set to require the app. However, it stores a regular TOTP code in the app, it's just encrypted with the android keystore.
I had to hook the base64 decoding function on my rooted phone to extract it, and put it in my password manager instead. I've been unable to figure out how to decrypt keystore-encrypted secrets in any other way.
Re: De-Googling TOTP Authenticator Codes
#123I’ve been using a Yubikey for TOTP codes for years.
When it’s plugged into my laptop, I use a fuzzy-search UI to pick the right credential, tap the Yubikey, and it writes the TOTP code into the focused text field.
There are iPhone and Android apps to generate codes. On iPhone, it works with nfc.
The same device also works for webauthn and for gpg. It has no network capabilities.
Re: De-Googling TOTP Authenticator Codes
#124I've been storing OTP secrets using `pass`[0] with `pass-otp`[1]. This does the whole symmetric encryption for me using `gpg`, decodes the URL for me to pass it into oathtool, and allows me to share the codes with my phone using Android Password Store[2]. This is all deceptively simple to set up, assuming you have a git server you trust to synchronize the codes with, or some kind of other method using maybe tailscale…
> This does the whole symmetric encryption for me using `gpg`
gpg actually uses a public/secret key pair with pass which has a pretty cool effect that you don't need to enter your passphrase when adding an entry to the store, because it uses the public key to encrypt.
Re: De-Googling TOTP Authenticator Codes
#125Earlier quoted context omitted.
I use this, but recently ran into an issue: I only have one Android device. It's great to be able to back up my secrets, but frustrating to need to spin up an emulator on my computer to run an Android app just to use the backups, if my primary device is offline for whatever reason. Is there a way to use the vault directly?
Very interesting question, I have no experience here. What I do instead is scan my QR codes into two apps on different devices when I make them (I do not make them very frequently so it's not a chore). Because I'm sort of pessimistic after a lifetime working in tech - everything that uses electricity breaks and fails. I build redundancy into all my (things) and just expect one of them to fail. Goes for email provider…
> What I do instead is scan my QR codes into two apps on different devices when I make them
Amazingly, I'd never even considered this as a possibility. Thank you for the paradigm shift.
Re: De-Googling TOTP Authenticator Codes
#126Earlier quoted context omitted.
I believe Aegis has you sorted with Steam as well
Couldn't Steam break this any second though?
Or one could run into some edge case, e.g. when Steam asks for different code when trying to change Steam password - https://github.com/beemdevelopment/Aegis/issues/1613 .
Re: De-Googling TOTP Authenticator Codes
#127The worst offender in 2FA business is Steam, as it uses custom 2FA and you must install their app - no way to use 3rd party OTP without jumping through hoops and risking security.
I believe Aegis has you sorted with Steam as well
https://github.com/beemdevelopment/Aegis/blob/v3.4.1/app/src...
> // NOTE: this assumes that a global root shell has already been obtained by the caller
:-/
My recollection when I last tried this stunt is that it's a boatload of nonsense to try and exfiltrate the Steam credential material, and I wasn't able to find any supporting docs in the Aegis nor on their site about any alternative they have to "root your phone and sniff the keys out of the sibling app"
Re: De-Googling TOTP Authenticator Codes
#128Earlier quoted context omitted.
> If you log into accounts from your phone, that's also 1fa in the same way. Not quite, there's a lot more sandboxing on phones than what might go on with desktop.
That sandboxing doesn't help if your phone gets stolen.
iphones are pretty secure against theft unless they get your pin or some such. I have two friends who forgot their own pins and the data was unretrievable in spite of their best efforts.
Re: De-Googling TOTP Authenticator Codes
#129Can I put a recommendation out there for andOTP?
* Open source
* Support for encrypted backups
* It allows you to peek at the previous 30 seconds code (so it doesn't just vanish if you're halfway through typing it)
* Lockable via pin or pass etc
* Filterable views
Re: De-Googling TOTP Authenticator Codes
#130Earlier quoted context omitted.
Very interesting question, I have no experience here. What I do instead is scan my QR codes into two apps on different devices when I make them (I do not make them very frequently so it's not a chore). Because I'm sort of pessimistic after a lifetime working in tech - everything that uses electricity breaks and fails. I build redundancy into all my (things) and just expect one of them to fail. Goes for email provider…
> What I do instead is scan my QR codes into two apps on different devices when I make them Amazingly, I'd never even considered this as a possibility. Thank you for the paradigm shift.
I do that too, but you don't really need to with Aegis as it has import/export.
Aegis also works very well on Android Go dumb-ish phones.