De-Googling TOTP Authenticator Codes • Hacker News Board

Re: De-Googling TOTP Authenticator Codes

#131

Post by philistine » Tue, Sep 02, 2025, 12:14 AM UTC

bkettle wrote: post #116

ori_b wrote: post #88

Earlier quoted context omitted.

If you log into accounts from your phone, that's also 1fa in the same way. And if you keep your phone in the same place as your laptop, so it can get stolen at the same time, that's also effectively 1fa. The threats that TOTP protects against are ones that don't involve losing your device. For example, if somebody breaches a password database or phishes your password, TOTP codes prevent them from using the leaked cre…

It depends on the phone, but for many phones the security story remains very good even when lost, unless someone knows your passcode. So it’s still “something you know” protecting the password and the TOTP code, but it’s different things that you know and strict rate-limiting on the phone side that wouldn’t be possible on an internet-exposed authentication system makes it extremely difficult to guess the phone passco…

I don’t think we need to couch it in unclear terms: Apple and Google have made very secure devices that happen to be phones, with Apple’s computers as locked rock solid as their phones now.

It’s Microsoft that’s stuck in unsafe grounds, and it’s partly the cultural apathy of their user base that’s at fault.

Re: De-Googling TOTP Authenticator Codes

#132

Post by 1oooqooq » Tue, Sep 02, 2025, 5:04 AM UTC

butz wrote: post #100

The worst offender in 2FA business is Steam, as it uses custom 2FA and you must install their app - no way to use 3rd party OTP without jumping through hoops and risking security.

same with the european commission. they are turning standard otp off and requiring a custom phone only app.

guess they cannot wait for passkeys to tie you to one apple or google account.

Re: De-Googling TOTP Authenticator Codes

#133

Post by nabogh » Tue, Sep 02, 2025, 7:45 AM UTC

I actually write down the secret for all my totp codes in a notebook as a backup

Re: De-Googling TOTP Authenticator Codes

#134

Post by styanax » Tue, Sep 02, 2025, 10:23 AM UTC

com2kid wrote: post #104

styanax wrote: post #29

Earlier quoted context omitted.

I would recommend Aegis Authenticator [1] - available in the Play store or F-Droid. It's been featured on HN now and again. One thing it can do is import the data of all the other OTP apps, and create backup files (the seeds) which you can do whatever you want with. [1] https://github.com/beemdevelopment/Aegis

Keepass now supports 2fa tokens, just use that. Plenty of open source clients on different platforms and you can sync the encrypted database file using whatever mechanism you like, drop box, one drive, etc.

KeepassXC (Linux) can import Bitwarden files directly as well, as both programs support H/TOTP there's a solution here. Not what I do, but I can see the use case aligning to the GP's comment - using Bitwarden (e.g.) as the TOTP app could allow importing it's backups to KeepassXC if your main/only mobile device fails and you only have a laptop etc.

Re: De-Googling TOTP Authenticator Codes

#135

Post by patrakov » Tue, Sep 02, 2025, 3:40 PM UTC

mid-kid wrote: post #122

butz wrote: post #100

The worst offender in 2FA business is Steam, as it uses custom 2FA and you must install their app - no way to use 3rd party OTP without jumping through hoops and risking security.

At work we use OneLogin, set to require the app. However, it stores a regular TOTP code in the app, it's just encrypted with the android keystore. I had to hook the base64 decoding function on my rooted phone to extract it, and put it in my password manager instead. I've been unable to figure out how to decrypt keystore-encrypted secrets in any other way.

You could have also used "fridump" [0] to dump the app memory and search for strings that look like TOTP secrets.

[0] https://github.com/rootbsd/fridump3

Re: De-Googling TOTP Authenticator Codes

#136

Post by patrakov » Tue, Sep 02, 2025, 3:56 PM UTC

freehorse wrote: post #59

What is the reasoning that google makes it so complicated to export the TOTPs? Is it just to make it harder to migrate to other authenticators (which does not make much sense because other authenticators just build their tool to import this anyway) or is it just a bad case of "security through obscurity"? I cannot imagine any minimally dedicated attacker that has already put the effort to get the export qr code not b…

There was a misguided line of reasoning that if you can back up a digital artifact, it is no longer eligible as a "something you have" type of security credential.

Earlier versions of Google Authenticator did not have any export functionality at all, and the only way to transfer the codes to a new phone was to use a Google backup of the old phone, which is only possible during the initial setup.

Re: De-Googling TOTP Authenticator Codes

#137

Post by Marsymars » Tue, Sep 02, 2025, 8:05 PM UTC

lokar wrote: post #115

Marsymars wrote: post #109

Earlier quoted context omitted.

> Secure Enclave (so 2nd factor to unlock that) How so?

You need the fingerprint sensor to unlock it

I don't think you do. My Mac Mini has the same Secure Enclave as other devices with the M4/A18 SoC, and it literally doesn't have a fingerprint reader (or Face ID).

The Secure Enclave is used to handle data around biometrics, but biometrics aren't a requirement for its use.

Biometrics on Apple devices are generally a convenience method so that you don't have to type your strong password every time, they're not a second factor to the password.

Re: De-Googling TOTP Authenticator Codes

#138

Post by mid-kid » Tue, Sep 02, 2025, 9:46 PM UTC

geoka9 wrote: post #124

mid-kid wrote: post #103

I've been storing OTP secrets using `pass`[0] with `pass-otp`[1]. This does the whole symmetric encryption for me using `gpg`, decodes the URL for me to pass it into oathtool, and allows me to share the codes with my phone using Android Password Store[2]. This is all deceptively simple to set up, assuming you have a git server you trust to synchronize the codes with, or some kind of other method using maybe tailscale…

> This does the whole symmetric encryption for me using `gpg` gpg actually uses a public/secret key pair with pass which has a pretty cool effect that you don't need to enter your passphrase when adding an entry to the store, because it uses the public key to encrypt.

You're right, gpg does asymmetric encryption. Don't know how I got that wrong, lol. But yeah the asymmetric part isn't really used in this context.