De-Googling TOTP Authenticator Codes • Hacker News Board

Re: De-Googling TOTP Authenticator Codes

#51

Post by broken-kebab » Mon, Sep 01, 2025, 11:11 AM UTC

Aachen wrote: post #44

alanfranz wrote: post #27

Earlier quoted context omitted.

If you login from your phone, it’s still one device. Should we have different totps for different devices? Something that you have can be your own pc.

You're onto something even banks don't seem to understand! The industry standard for doing financial transactions calls for 2FA but then they make a mobile app that can self-approve transactions. Yes, using only one mobile device is 1FA, just like using one desktop only, but people generally consider mobile OSes safer because the permission model and process isolation is on a whole other level

There's a grain of truth in your statement, but no matter how hard it's to accept for all of us nerds here, in real life words are defined by usage. If industry calls it 2FA, users call it 2FA, then it's 2FA.

Re: De-Googling TOTP Authenticator Codes

#52

Post by tedk-42 » Mon, Sep 01, 2025, 11:14 AM UTC

Most people don't really know how these TOTP codes work but yeah for the longest time I've just put the plain text secret in a place where I can wrap it with my own golang utility

https://github.com/edify42/otp-codegen

Way easier to open a terminal on my computer and pipe to `pbcopy` and paste it onto the screen.

Re: De-Googling TOTP Authenticator Codes

#53

Post by tedk-42 » Mon, Sep 01, 2025, 11:14 AM UTC

44za12 wrote: post #10

Shameless plug. I’ve been using a cli tool i had created for over 2 years now, it just works. I had more ideas but never got to incorporate those. https://github.com/44za12/horcrux

6 years for me if we're counting :)

https://github.com/edify42/otp-codegen

Re: De-Googling TOTP Authenticator Codes

#54

Post by riedel » Mon, Sep 01, 2025, 11:17 AM UTC

Aachen wrote: post #47

riedel wrote: post #12

Earlier quoted context omitted.

I also have the same problem, however, I think Microsoft started to use some proprietary protocol wit some challenge / response scheme.

Yes, Microsoft tries to get you to use their proprietary mechanism by default. You need to click on the "use a different method" link when doing the setup to get a code that is compatible with e.g. Google Authenticator, FreeOTP, and all the other ones

The last time I tried to that for an external MS Teams instance, the option to use another method was gone. Could have been a compliance thing of the 'owner' of the instance, however, I actually tried multiple times to circumvent installing their app, but failed.

Re: De-Googling TOTP Authenticator Codes

#55

Post by Aachen » Mon, Sep 01, 2025, 11:18 AM UTC

broken-kebab wrote: post #51

Aachen wrote: post #44

Earlier quoted context omitted.

You're onto something even banks don't seem to understand! The industry standard for doing financial transactions calls for 2FA but then they make a mobile app that can self-approve transactions. Yes, using only one mobile device is 1FA, just like using one desktop only, but people generally consider mobile OSes safer because the permission model and process isolation is on a whole other level

There's a grain of truth in your statement, but no matter how hard it's to accept for all of us nerds here, in real life words are defined by usage. If industry calls it 2FA, users call it 2FA, then it's 2FA.

They can call the sky green but unless the wavelength changed, I don't see the benefit of taking over that terminology, no matter if you're a user or a nerd or both. That's the real-life situation: sky isn't green, idk why anyone would need to "accept" that or not when it factually isn't the case

Re: De-Googling TOTP Authenticator Codes

#56

Post by s2l » Mon, Sep 01, 2025, 11:19 AM UTC

zeta0134 wrote: post #37

styanax wrote: post #29

Earlier quoted context omitted.

I would recommend Aegis Authenticator [1] - available in the Play store or F-Droid. It's been featured on HN now and again. One thing it can do is import the data of all the other OTP apps, and create backup files (the seeds) which you can do whatever you want with. [1] https://github.com/beemdevelopment/Aegis

I use this, but recently ran into an issue: I only have one Android device. It's great to be able to back up my secrets, but frustrating to need to spin up an emulator on my computer to run an Android app just to use the backups, if my primary device is offline for whatever reason. Is there a way to use the vault directly?

1. Aegis has a setting for creating secure backup on every change. 2. Autosync that backup directory via syncthing to your PC. 3. Run a compatible desktop software (e.g. linux has authenticator) to import aegis backup files manually.

Since totp addition is not a frequent activity, the last manual import step was not a hassle to do whenever needed.

Re: De-Googling TOTP Authenticator Codes

#57

Post by 8cvor6j844qw_d6 » Mon, Sep 01, 2025, 11:22 AM UTC

This reminds me of Steve Gibson storing his 2FA seeds by printing them out [1].

> "Steve: So in my drawer I have all of my QR codes printed."

> "Steve: They're in a safe place. And if it ever comes to the point where I need to set up a new authenticator, not a problem. I just scan the QR codes once again, and we're back in business. So the other thing to look for is an authenticator that will allow you to do that because it is nice to have hard copy backup."

---

I'm not sure what TOTP app he's using currently, since this was said 2 years ago [1].

> "Steve: OTP space Auth, and the logo is a simple gray padlock. Very modest logo. And it does all of this correctly."

[1]: https://www.grc.com/sn/sn-921.htm

Re: De-Googling TOTP Authenticator Codes

#58

Post by xethos » Mon, Sep 01, 2025, 11:22 AM UTC

zeta0134 wrote: post #37

styanax wrote: post #29

Earlier quoted context omitted.

I would recommend Aegis Authenticator [1] - available in the Play store or F-Droid. It's been featured on HN now and again. One thing it can do is import the data of all the other OTP apps, and create backup files (the seeds) which you can do whatever you want with. [1] https://github.com/beemdevelopment/Aegis

I use this, but recently ran into an issue: I only have one Android device. It's great to be able to back up my secrets, but frustrating to need to spin up an emulator on my computer to run an Android app just to use the backups, if my primary device is offline for whatever reason. Is there a way to use the vault directly?

Aegis authenticator backups can be imported into Gnome Authenticator. I'm using it, I know it works, but I don't recall the format GA requires

Re: De-Googling TOTP Authenticator Codes

#59

Post by freehorse » Mon, Sep 01, 2025, 11:22 AM UTC

What is the reasoning that google makes it so complicated to export the TOTPs? Is it just to make it harder to migrate to other authenticators (which does not make much sense because other authenticators just build their tool to import this anyway) or is it just a bad case of "security through obscurity"? I cannot imagine any minimally dedicated attacker that has already put the effort to get the export qr code not being able to actually read it, but it just makes it harder for "common" people to actually get their codes. I remember I had to go through what the article describes to access my TOTPs and migrate to another authenticator.

Re: De-Googling TOTP Authenticator Codes

#60

Post by wolvesechoes » Mon, Sep 01, 2025, 11:22 AM UTC

speedgoose wrote: post #18

wolvesechoes wrote: post #14

Earlier quoted context omitted.

You are allowed to have two separate databases, with different passwords. You can even store them on different devices!

It’s still one device.

If you store two databases on two devices it makes them suddenly one device? What kind of security sorcery is this?