Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

De-Googling TOTP Authenticator Codes

imrannazar.com

Post reply on HN
Print view View original

31–40 of 138 posts

Re: De-Googling TOTP Authenticator Codes

#31

Post by ezst »

Some time ago I realised how vulnerable I was keeping all my TOTPs in Authenticator __only__, in the event of losing/breaking my device (and no, there is no way I would sync them to Google cloud). This taught me few things:

- there isn't much to Authenticator and TOTPs in general, it's just a secret, which can be shared across multiple TOTP managers and devices. I had solved the "single point of failure" concern

- that opened a new need for "safe TOTP replication with offline access", and that's how I ended-up running my own vaultwarden instance and using the bitwarden clients across devices.

I'm glad I did, and I can't recommend it more. IIRC, this¹ helped tremendously along the way.

¹: https://github.com/scito/extract_otp_secrets

Re: De-Googling TOTP Authenticator Codes

#32

Post by styanax »

progbits wrote: post #3
tigrezno wrote: post #2

For years I've managed all my TOTP codes with KeepassXC. Not a single problem, great software.

I can recommend the Aegis app for Android. Works great and has encrypted backups.

Replied to another comment with the same recommendation before seeing this, here's the URL for those interested:

https://github.com/beemdevelopment/Aegis

Re: De-Googling TOTP Authenticator Codes

#33

Post by mrweasel »

eek2121 wrote: post #9

I wish there was a way to export my codes from Microsoft authenticator on iOS. If anyone knows of a way to do this, please feel free to reply. I would like to move to an open source solution.

Learned that the hard way, never ever add ANYTHING to the Microsoft Authenticator app if you can avoid it. It is impossible to migrate to something else.

I had a client where I got a new phone and forgot about the Microsoft Authenticator. Three months later I had to go on site with the client to reset my Authenticator as signups could only be done from their network.

Re: De-Googling TOTP Authenticator Codes

#34

Post by tremon »

Aachen wrote: post #24
littlecosmic wrote: post #21

Earlier quoted context omitted.

The risk factor is mainly that someone got the password from a web application hack not that they logged into your computer and accessed your password manager. In the web app scenario it is still a second factor.

If you use a password manager, or another mechanism that makes each password unique and unguessable, the password and the "2FA" seed token are both the same type of secret string, and both are stored on the same disk. There is no added benefit to 2FA if you store the 2FA secret next to the password when both are generated securely But I'm not saying you should care about this. Everyone can make their own risk assessm…

the password and the "2FA" seed token are both the same type of secret string

This is a category error. The 2FA seed token may be a string of bytes just like the password, but the seed is never communicated outside your device. That makes them different types of secrets: a capture of the transmitted login codes will not compromise the 2FA seed. Even if you auto-generate the password in the same way, it's the actual valuable secret that needs to leave your device -- by design.

I don't know if a website database breach compromises both keys. Is the 2FA seed a pre-shared key, or is the algorithm asymmetric? I seriously hope it's the latter, but I don't know for sure.

Re: De-Googling TOTP Authenticator Codes

#35

Post by Aachen »

StrLght wrote: post #22
blackbear_ wrote: post #4

Earlier quoted context omitted.

Just consider that storing TOTP codes in the password manager negates the advantage of two factors authentication, namely the added security of needing a second device. This would keep your logins safe even if somebody managed to breach your KeePassXC database.

> negates the advantage of two factors authentication Like with all things it depends on your threat model. If your threat model includes risk of leaking all data from your password manager – then yeah, it worsens your security. Otherwise it still covers all other risks: 1. it makes bruteforce basically impossible 2. it makes phishing harder (assuming that your password manager supports autofill and that it checks do…

All of this is true without 2FA, just storing securely generated passwords in the manager.

Whether it negates the benefits of 2FA (i.e. whether it's 1FA) doesn't depend on the threat model. The threat model is what makes an individual decide whether 2FA is worth it

Re: De-Googling TOTP Authenticator Codes

#37

Post by zeta0134 »

styanax wrote: post #29
Aachen wrote: post #13

To be clear, the point of storing a secret token on your phone and then typing over some codes that prove you have access to the secret still, is to provide 2FA. If you use oathtool on your laptop, and the password is stored there as well, you're back to 1FA That can be fine if that's what you want, but if you wanted 2FA: - FreeOTP: https://f-droid.org/packages/org.fedorahosted.freeotp - someone forked that and calle…

I would recommend Aegis Authenticator [1] - available in the Play store or F-Droid. It's been featured on HN now and again. One thing it can do is import the data of all the other OTP apps, and create backup files (the seeds) which you can do whatever you want with. [1] https://github.com/beemdevelopment/Aegis

I use this, but recently ran into an issue: I only have one Android device. It's great to be able to back up my secrets, but frustrating to need to spin up an emulator on my computer to run an Android app just to use the backups, if my primary device is offline for whatever reason. Is there a way to use the vault directly?

Re: De-Googling TOTP Authenticator Codes

#38

Post by fulafel »

Aachen wrote: post #13

To be clear, the point of storing a secret token on your phone and then typing over some codes that prove you have access to the secret still, is to provide 2FA. If you use oathtool on your laptop, and the password is stored there as well, you're back to 1FA That can be fine if that's what you want, but if you wanted 2FA: - FreeOTP: https://f-droid.org/packages/org.fedorahosted.freeotp - someone forked that and calle…

> If you use oathtool on your laptop, and the password is stored there as well, you're back to 1FA

In estabilished terminology you don't need multiple independent devices. For example email "magic link" is a common second factor.

Re: De-Googling TOTP Authenticator Codes

#39

Post by Aachen »

quchen wrote: post #26
speedgoose wrote: post #18

Earlier quoted context omitted.

It’s still one device.

The second factor does not have to be a second device . Like everything security, it’s what you’re protecting against. Shoulder surfing and device theft are not something I worry about in my home setup, for example.

> The second factor does not have to be a second device. Like everything security, it’s what you’re protecting against.

It doesn't matter if you store your 2FA seed on a billboard or as a tattoo where the sun doesn't shine: 2FA means two factors. The definition doesn't change when your home setup's threat model doesn't call for 2FA and you thus decide to store two secrets in the same place (making a compromise of one necessarily a compromise of the other, thus 1FA)

Post reply on HN