Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TOTP tokens on my wrist with the smartest dumb watch

blog.singleton.io

Post reply on HN
Print view View original

91–100 of 131 posts

Re: TOTP tokens on my wrist with the smartest dumb watch

#91

Post by adamgordonbell »

distcs wrote: post #50

Is there some Unix-ish tool to generate these TOTPs on a laptop? I don't like to keep the 2nd factor on a small mobile device that is easy to lose. So I ask about a laptop tool. By Unix-ish I mean something that is small and does one thing well. Like pipe in a secret to it and it gives me a TOTP? Pipe in multiple secrets and it gives me multiple TOTPs? Then I don't have to remain beholden to a custom encryption forma…

I think you want oathtool.

You can also use python's pyotp.totp.now()

https://earthly.dev/blog/multi-factor-auth/

Re: TOTP tokens on my wrist with the smartest dumb watch

#92

Post by kamranjon »

This is very cool, I just recently ordered a light phone 2 (a dumb phone) - and one of the things I am currently trying to solve is how I am going to access my google authentication codes for various work and personal project related accounts. Something like this would be very awesome, but also this post really demystifies how this type of auth works.

Re: TOTP tokens on my wrist with the smartest dumb watch

#93

Post by andrepd »

cbm-vic-20 wrote: post #84

I just wanted to call out how cool it is to replace the guts of a 1980s-era wristwatch with a ARM Cortex M0+ microcontroller, while reusing the original display and buttons.

One of my long-term hacker project goals is to replace the guts of an analog watch with a microcontroller and turn it into a "smartwatch-lite". There's a surprising amount of information and features you can display with three pointers (and a small numeric window): temperature, heartrate and other body sensors, NFC to replace payment or access cards, etc.

Re: TOTP tokens on my wrist with the smartest dumb watch

#94

Post by jabroni_salad »

maeln wrote: post #71
GekkePrutser wrote: post #42

Earlier quoted context omitted.

I use AndOTP on Android. You can export to a PGP-encrypted JSON file so your keys are really your own and not locked into a walled garden like Authy.

Aegis is another open-source option. It can import the andOTP format and can also export the keys, but has the advantage of being able to use fingerprint unlock.

I also like that Aegis has folders so I can separate my work and personal stuff. Most of the others are just a flat list.

Re: TOTP tokens on my wrist with the smartest dumb watch

#95

Post by jabroni_salad »

Avamander wrote: post #44
k8sToGo wrote: post #35

Earlier quoted context omitted.

I use Authy as well. Best part is it backups your stuff.

Are those backups E2EE? Also to be totally honest, each device should have their own TOTP key and while backups are fine*, key sharing isn't.

Key sharing isnt fine but how many web services will let me enroll multiple totp tokens simultaneously? I havent encountered any, personally. yall designed this reality, now you have to live in it.

Re: TOTP tokens on my wrist with the smartest dumb watch

#97

Post by twalla »

susam wrote: post #69
grenoire wrote: post #64

Earlier quoted context omitted.

I just cooked up something in Python if you have it installed on your system, quite straightforward to use. If there's interest, I can prepare a compiled version. Unlike the other ones posted here, this one just takes secrets as arguments: > python -mtotp DGLTPWEUERUUDCEC SWPKQCKEWRXPCRXE 628502 674329 https://pastebin.com/apNKxMBF

I believe it is worth mentioning here that reading secrets from command line arguments exposes the secrets in shell history (e.g., ~/.bash_history, ~/.zsh_history, etc.), thus writing the secrets in cleartext to the filesystem. If command line auditing is enabled on a system, any secrets in command line arguments would be exposed in such audit logs too. Further, if multiple users are logged into the same system (perh…

fun fact: you can teach your shell to ignore commands that begin with a space character. in bash $HISTCONTROL needs to be ignorespace or ignoreboth, in zsh you must setopt HIST_IGNORE_SPACE

Re: TOTP tokens on my wrist with the smartest dumb watch

#98

Post by samcat116 »

This is super cool but do folks really need their google and GitHub 2FA codes often enough to justify this? Browser sessions are pretty durable it seems. The one thing I could think of is GitHub admin type actions that prompt for a credential to enter “sudo” mode or whatever they call it. However in that case they’ll take your password as well (or a webauthn key in my case)

Re: TOTP tokens on my wrist with the smartest dumb watch

#99

Post by Tijdreiziger »

niel wrote: post #21
xupybd wrote: post #5

Earlier quoted context omitted.

Can you recommend any cheap USB security keys? I've looked in the past and cost has been prohibitive.

Cloudflare and Yubico are in partnership to provide YubiKeys at a discount: https://www.cloudflare.com/products/zero-trust/phishing-resi... Related thread: https://news.ycombinator.com/item?id=33020078

> Eligible customers must have an active zone or actively use Cloudflare Zero Trust.

Re: TOTP tokens on my wrist with the smartest dumb watch

#100

Post by edent »

samcat116 wrote: post #98

This is super cool but do folks really need their google and GitHub 2FA codes often enough to justify this? Browser sessions are pretty durable it seems. The one thing I could think of is GitHub admin type actions that prompt for a credential to enter “sudo” mode or whatever they call it. However in that case they’ll take your password as well (or a webauthn key in my case)

I use systems which require a 2FA code every day, or whenever a destructive action takes place.

So this is certainly useful for some people.

Post reply on HN