Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TOTP tokens on my wrist with the smartest dumb watch

blog.singleton.io

Post reply on HN
Print view View original

71–80 of 131 posts

Re: TOTP tokens on my wrist with the smartest dumb watch

#71

Post by maeln »

GekkePrutser wrote: post #42
ayewo wrote: post #26

Earlier quoted context omitted.

I use Duo Mobile [1] with my Apple Watch. Authy gets recommended often here but got turned off of them because they require a phone number to set up the app on iOS. There's no phone number requirement for TOTP implementations so I eventually found Duo Mobile. This was before they got bought by Cisco. 1: https://apps.apple.com/us/app/duo-mobile/id422663827

I use AndOTP on Android. You can export to a PGP-encrypted JSON file so your keys are really your own and not locked into a walled garden like Authy.

Aegis is another open-source option. It can import the andOTP format and can also export the keys, but has the advantage of being able to use fingerprint unlock.

Re: TOTP tokens on my wrist with the smartest dumb watch

#72

Post by stavros »

rjzzleep wrote: post #11
madc wrote: post #9

Earlier quoted context omitted.

Have you looked into these? https://solokeys.com

I was a backer of the V2 and I think my order is now a year overdue. I don't really back things on kickstarter because I don't like to gamble, but this seemed like a sure bet. Turns out it wasn't.

I got mine (and it randomly died so they sent me a second one). You still haven't received your first one? That sucks, they're generally very good devices (minus them randomly dying, I guess).

Re: TOTP tokens on my wrist with the smartest dumb watch

#73

Post by aw1cks »

distcs wrote: post #50

Is there some Unix-ish tool to generate these TOTPs on a laptop? I don't like to keep the 2nd factor on a small mobile device that is easy to lose. So I ask about a laptop tool. By Unix-ish I mean something that is small and does one thing well. Like pipe in a secret to it and it gives me a TOTP? Pipe in multiple secrets and it gives me multiple TOTPs? Then I don't have to remain beholden to a custom encryption forma…

pass-otp[0] integrates into pass[1] nicely. It's about as unix-y as password/secret management comes in my eyes.

Alternatively, gopass[2], which re-implements pass in golang, has this functionality built in[3].

[0] https://github.com/tadfisher/pass-otp

[1] https://www.passwordstore.org/

[2] https://www.gopass.pw/

[3] https://github.com/gopasspw/gopass/blob/master/docs/commands...

Re: TOTP tokens on my wrist with the smartest dumb watch

#74

Post by thomc »

maeln wrote: post #71
GekkePrutser wrote: post #42

Earlier quoted context omitted.

I use AndOTP on Android. You can export to a PGP-encrypted JSON file so your keys are really your own and not locked into a walled garden like Authy.

Aegis is another open-source option. It can import the andOTP format and can also export the keys, but has the advantage of being able to use fingerprint unlock.

AndOTP can use your fingerprint as well. Settings->Authentication->Device Credentials

Re: TOTP tokens on my wrist with the smartest dumb watch

#75

Post by nashashmi »

distcs wrote: post #50

Is there some Unix-ish tool to generate these TOTPs on a laptop? I don't like to keep the 2nd factor on a small mobile device that is easy to lose. So I ask about a laptop tool. By Unix-ish I mean something that is small and does one thing well. Like pipe in a secret to it and it gives me a TOTP? Pipe in multiple secrets and it gives me multiple TOTPs? Then I don't have to remain beholden to a custom encryption forma…

Totp.app is a great web app. So you can install on your phone as well

Re: TOTP tokens on my wrist with the smartest dumb watch

#76

Post by [deleted] »

nashashmi wrote: post #75
distcs wrote: post #50

Is there some Unix-ish tool to generate these TOTPs on a laptop? I don't like to keep the 2nd factor on a small mobile device that is easy to lose. So I ask about a laptop tool. By Unix-ish I mean something that is small and does one thing well. Like pipe in a secret to it and it gives me a TOTP? Pipe in multiple secrets and it gives me multiple TOTPs? Then I don't have to remain beholden to a custom encryption forma…

Totp.app is a great web app. So you can install on your phone as well

[deleted]

Re: TOTP tokens on my wrist with the smartest dumb watch

#77

Post by Amorymeltzer »

distcs wrote: post #50

Is there some Unix-ish tool to generate these TOTPs on a laptop? I don't like to keep the 2nd factor on a small mobile device that is easy to lose. So I ask about a laptop tool. By Unix-ish I mean something that is small and does one thing well. Like pipe in a secret to it and it gives me a TOTP? Pipe in multiple secrets and it gives me multiple TOTPs? Then I don't have to remain beholden to a custom encryption forma…

From today! https://drewdevault.com/2022/10/18/TOTP-is-easy.html

Re: TOTP tokens on my wrist with the smartest dumb watch

#78

Post by grenoire »

susam wrote: post #69
grenoire wrote: post #64

Earlier quoted context omitted.

I just cooked up something in Python if you have it installed on your system, quite straightforward to use. If there's interest, I can prepare a compiled version. Unlike the other ones posted here, this one just takes secrets as arguments: > python -mtotp DGLTPWEUERUUDCEC SWPKQCKEWRXPCRXE 628502 674329 https://pastebin.com/apNKxMBF

I believe it is worth mentioning here that reading secrets from command line arguments exposes the secrets in shell history (e.g., ~/.bash_history, ~/.zsh_history, etc.), thus writing the secrets in cleartext to the filesystem. If command line auditing is enabled on a system, any secrets in command line arguments would be exposed in such audit logs too. Further, if multiple users are logged into the same system (perh…

I should indeed have mentioned that. On the other hand, this is not a concern if you do not execute the it outside your shell (e.g. in another script that reads TOTP secrets from elsewhere).

Re: TOTP tokens on my wrist with the smartest dumb watch

#80

Post by throwawaaarrgh »

rjzzleep wrote: post #16
jgrahamc wrote: post #12

Earlier quoted context omitted.

TOTP is really vulnerable to phishing. Hardware keys are the solution.

Yeah, sure, but then again a watch on your wrist is harder to take away than a hardware key on your physical keychain that you don't pay attention to. EDIT: yes, lol, thank you for explaining what phishing is jgrahamc. We didn't know. I get that a lot of Americans and some Germans guard their car keys like an internal organ, but for a lot of people in the world a keychain is something you toss in an insecure place mo…

stealing watches is pretty trivial if you practice. but also TOTP is just more inconvenient than, say, the Microsoft authenticator with biometric confirm and server push, or a token you just press that's near your computer or phone. the fact that these can also help defeat phishing is just one more benefit.
Post reply on HN