Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

De-Googling TOTP Authenticator Codes

imrannazar.com

Post reply on HN
Print view View original

21–30 of 138 posts

Re: De-Googling TOTP Authenticator Codes

#21

Post by littlecosmic »

Aachen wrote: post #13

To be clear, the point of storing a secret token on your phone and then typing over some codes that prove you have access to the secret still, is to provide 2FA. If you use oathtool on your laptop, and the password is stored there as well, you're back to 1FA That can be fine if that's what you want, but if you wanted 2FA: - FreeOTP: https://f-droid.org/packages/org.fedorahosted.freeotp - someone forked that and calle…

The risk factor is mainly that someone got the password from a web application hack not that they logged into your computer and accessed your password manager. In the web app scenario it is still a second factor.

Re: De-Googling TOTP Authenticator Codes

#22

Post by StrLght »

blackbear_ wrote: post #4
tigrezno wrote: post #2

For years I've managed all my TOTP codes with KeepassXC. Not a single problem, great software.

Just consider that storing TOTP codes in the password manager negates the advantage of two factors authentication, namely the added security of needing a second device. This would keep your logins safe even if somebody managed to breach your KeePassXC database.

> negates the advantage of two factors authentication

Like with all things it depends on your threat model.

If your threat model includes risk of leaking all data from your password manager – then yeah, it worsens your security.

Otherwise it still covers all other risks:

1. it makes bruteforce basically impossible

2. it makes phishing harder (assuming that your password manager supports autofill and that it checks domains correctly)

3. it lowers the risks if a single password leaks

Re: De-Googling TOTP Authenticator Codes

#24

Post by Aachen »

littlecosmic wrote: post #21
Aachen wrote: post #13

To be clear, the point of storing a secret token on your phone and then typing over some codes that prove you have access to the secret still, is to provide 2FA. If you use oathtool on your laptop, and the password is stored there as well, you're back to 1FA That can be fine if that's what you want, but if you wanted 2FA: - FreeOTP: https://f-droid.org/packages/org.fedorahosted.freeotp - someone forked that and calle…

The risk factor is mainly that someone got the password from a web application hack not that they logged into your computer and accessed your password manager. In the web app scenario it is still a second factor.

If you use a password manager, or another mechanism that makes each password unique and unguessable, the password and the "2FA" seed token are both the same type of secret string, and both are stored on the same disk. There is no added benefit to 2FA if you store the 2FA secret next to the password when both are generated securely

But I'm not saying you should care about this. Everyone can make their own risk assessment, especially if you know about common attacks like the data breaches that you mention

Re: De-Googling TOTP Authenticator Codes

#25

Post by littlecosmic »

Aachen wrote: post #24
littlecosmic wrote: post #21

Earlier quoted context omitted.

The risk factor is mainly that someone got the password from a web application hack not that they logged into your computer and accessed your password manager. In the web app scenario it is still a second factor.

If you use a password manager, or another mechanism that makes each password unique and unguessable, the password and the "2FA" seed token are both the same type of secret string, and both are stored on the same disk. There is no added benefit to 2FA if you store the 2FA secret next to the password when both are generated securely But I'm not saying you should care about this. Everyone can make their own risk assessm…

yes, fair points. Thanks for clarifying.

Re: De-Googling TOTP Authenticator Codes

#26

Post by quchen »

speedgoose wrote: post #18
wolvesechoes wrote: post #14

Earlier quoted context omitted.

You are allowed to have two separate databases, with different passwords. You can even store them on different devices!

It’s still one device.

The second factor does not have to be a second device. Like everything security, it’s what you’re protecting against. Shoulder surfing and device theft are not something I worry about in my home setup, for example.

Re: De-Googling TOTP Authenticator Codes

#27

Post by alanfranz »

speedgoose wrote: post #18
wolvesechoes wrote: post #14

Earlier quoted context omitted.

You are allowed to have two separate databases, with different passwords. You can even store them on different devices!

It’s still one device.

If you login from your phone, it’s still one device. Should we have different totps for different devices?

Something that you have can be your own pc.

Re: De-Googling TOTP Authenticator Codes

#28

Post by nicce »

Aachen wrote: post #13

To be clear, the point of storing a secret token on your phone and then typing over some codes that prove you have access to the secret still, is to provide 2FA. If you use oathtool on your laptop, and the password is stored there as well, you're back to 1FA That can be fine if that's what you want, but if you wanted 2FA: - FreeOTP: https://f-droid.org/packages/org.fedorahosted.freeotp - someone forked that and calle…

It is not necessarily 1FA even if just use the laptop.

One password could be leaked and if the password alone gives the access, that is 1FA.

If the combination of two tokens forces the each login require access to that laptop and you need some password to unlock the password vault, this adds 2FA layers to services which are not the password manager.

Re: De-Googling TOTP Authenticator Codes

#29

Post by styanax »

Aachen wrote: post #13

To be clear, the point of storing a secret token on your phone and then typing over some codes that prove you have access to the secret still, is to provide 2FA. If you use oathtool on your laptop, and the password is stored there as well, you're back to 1FA That can be fine if that's what you want, but if you wanted 2FA: - FreeOTP: https://f-droid.org/packages/org.fedorahosted.freeotp - someone forked that and calle…

I would recommend Aegis Authenticator [1] - available in the Play store or F-Droid. It's been featured on HN now and again. One thing it can do is import the data of all the other OTP apps, and create backup files (the seeds) which you can do whatever you want with.

[1] https://github.com/beemdevelopment/Aegis

Re: De-Googling TOTP Authenticator Codes

#30

Post by Aachen »

nicce wrote: post #28
Aachen wrote: post #13

To be clear, the point of storing a secret token on your phone and then typing over some codes that prove you have access to the secret still, is to provide 2FA. If you use oathtool on your laptop, and the password is stored there as well, you're back to 1FA That can be fine if that's what you want, but if you wanted 2FA: - FreeOTP: https://f-droid.org/packages/org.fedorahosted.freeotp - someone forked that and calle…

It is not necessarily 1FA even if just use the laptop. One password could be leaked and if the password alone gives the access, that is 1FA. If the combination of two tokens forces the each login require access to that laptop and you need some password to unlock the password vault, this adds 2FA layers to services which are not the password manager.

The password vault can't be copied? (In unlocked state I mean, same as how they could get the password)

Either your laptop is compromised or the server. In either case, if they get access to the password, they also get access to the 2FA secret if that resides in this vault together with the password. Just a password alone is safer than 2FA alone because that at least gets hashed and isn't stored in plain text on the server side

Post reply on HN