De-Googling TOTP Authenticator Codes • Hacker News Board

Re: De-Googling TOTP Authenticator Codes

#91

Post by prism56 » Mon, Sep 01, 2025, 2:55 PM UTC

sceptic123 wrote: post #79

Aachen wrote: post #13

To be clear, the point of storing a secret token on your phone and then typing over some codes that prove you have access to the secret still, is to provide 2FA. If you use oathtool on your laptop, and the password is stored there as well, you're back to 1FA That can be fine if that's what you want, but if you wanted 2FA: - FreeOTP: https://f-droid.org/packages/org.fedorahosted.freeotp - someone forked that and calle…

That's not 1FA, it's just not using a separate device as the second factor. There is definitely a decrease in security having the 2FA provider on the same device as the password manager, but it doesn't negate the majority of benefits of 2FA.

Yeah isn't the threat vector your password being leaked/cracked. You're still safe here.

The argument can me made that logging into something on your phone isn't 2FA either then...

Re: De-Googling TOTP Authenticator Codes

#92

Post by jorvi » Mon, Sep 01, 2025, 3:10 PM UTC

Aachen wrote: post #24

littlecosmic wrote: post #21

Earlier quoted context omitted.

The risk factor is mainly that someone got the password from a web application hack not that they logged into your computer and accessed your password manager. In the web app scenario it is still a second factor.

If you use a password manager, or another mechanism that makes each password unique and unguessable, the password and the "2FA" seed token are both the same type of secret string, and both are stored on the same disk. There is no added benefit to 2FA if you store the 2FA secret next to the password when both are generated securely But I'm not saying you should care about this. Everyone can make their own risk assessm…

> There is no added benefit to 2FA if you store the 2FA secret next to the password when both are generated securely

Over this entire thread you keep repeating this, and you're so confidently wrong.

If a hacker (or shoulder peeper) gets my password to a site without a TOTP, they can login. 1FA. If I also use a TOTP adjacently, the hacker can't login and the shoulder peeper has a window of 30 seconds.

Its 2FA. Storing critical TOTPs in your password manager is bad practice and thus bad 2FA, but its still 2FA.

Re: De-Googling TOTP Authenticator Codes

#93

Post by smw » Mon, Sep 01, 2025, 3:14 PM UTC

Aachen wrote: post #68

_Algernon_ wrote: post #45

Earlier quoted context omitted.

Even if pw and 2fa secret are stored together you get better protection against phishing because you never enter the full 2fa secret into a website.

Thanks for providing a concrete example where this is indeed the case! You're right, and I'm aware of this, but the scenario is quite constrained. This matters when: 1. The attacker either captures the OTPs on the real website, or on a phishing page. They do not have access to either the website's store of 2FA tokens, nor your password vault. and 2a. Having you enter one or two OTPs on the login page is not enough. T…

Better idea, use something that is able to authenticate the server and disallows fishing, like yubikeys or passkeys! Much less challenging to secure than showing something on the screen.

Re: De-Googling TOTP Authenticator Codes

#94

Post by lokar » Mon, Sep 01, 2025, 3:17 PM UTC

ori_b wrote: post #88

Aachen wrote: post #13

To be clear, the point of storing a secret token on your phone and then typing over some codes that prove you have access to the secret still, is to provide 2FA. If you use oathtool on your laptop, and the password is stored there as well, you're back to 1FA That can be fine if that's what you want, but if you wanted 2FA: - FreeOTP: https://f-droid.org/packages/org.fedorahosted.freeotp - someone forked that and calle…

If you log into accounts from your phone, that's also 1fa in the same way. And if you keep your phone in the same place as your laptop, so it can get stolen at the same time, that's also effectively 1fa. The threats that TOTP protects against are ones that don't involve losing your device. For example, if somebody breaches a password database or phishes your password, TOTP codes prevent them from using the leaked cre…

If you have a Mac, what about using keychain? It has a cli/api and is protected by the Secure Enclave (so 2nd factor to unlock that)

Re: De-Googling TOTP Authenticator Codes

#95

Post by oulipo2 » Mon, Sep 01, 2025, 3:25 PM UTC

Aachen wrote: post #13

To be clear, the point of storing a secret token on your phone and then typing over some codes that prove you have access to the secret still, is to provide 2FA. If you use oathtool on your laptop, and the password is stored there as well, you're back to 1FA That can be fine if that's what you want, but if you wanted 2FA: - FreeOTP: https://f-droid.org/packages/org.fedorahosted.freeotp - someone forked that and calle…

1Password works well too (Canadian company I think)

Re: De-Googling TOTP Authenticator Codes

#96

Post by whartung » Mon, Sep 01, 2025, 3:31 PM UTC

8cvor6j844qw_d6 wrote: post #57

This reminds me of Steve Gibson storing his 2FA seeds by printing them out [1]. > "Steve: So in my drawer I have all of my QR codes printed." > "Steve: They're in a safe place. And if it ever comes to the point where I need to set up a new authenticator, not a problem. I just scan the QR codes once again, and we're back in business. So the other thing to look for is an authenticator that will allow you to do that bec…

This is actually an interesting idea.

I have my e.g. GitHub recovery codes printed out. I have to assume that the recovery codes are more flexible, but rescanning the original QR code would be better UX in case of loss simply because GitHub is not involved, they're nevertheless wiser.

But the recovery codes are process agnostic. I imagine they work whether you're using TOTP or any other 2FA mechanic. If GitHub deigns to discontinue support for TOTP, then the printer QR code won't be much help.

In the end, however, I have a piece of paper (or other visual artifact) with security information to manage.

I will keep the persistent QR code concept in my bonnet for potential consideration in the future.

Re: De-Googling TOTP Authenticator Codes

#97

Post by hypeatei » Mon, Sep 01, 2025, 3:38 PM UTC

blackbear_ wrote: post #4

tigrezno wrote: post #2

For years I've managed all my TOTP codes with KeepassXC. Not a single problem, great software.

Just consider that storing TOTP codes in the password manager negates the advantage of two factors authentication, namely the added security of needing a second device. This would keep your logins safe even if somebody managed to breach your KeePassXC database.

It doesn't negate the advantage of 2FA. There are so many scenarios that don't involve your entire password manager database being leaked in plaintext. In that case, you likely have much more to worry about considering the attacker has a bunch of places to pivot from (account recovery flows, recovery email accounts, etc..)

Re: De-Googling TOTP Authenticator Codes

#98

Post by nerdsniper » Mon, Sep 01, 2025, 3:43 PM UTC

Aachen wrote: post #13

To be clear, the point of storing a secret token on your phone and then typing over some codes that prove you have access to the secret still, is to provide 2FA. If you use oathtool on your laptop, and the password is stored there as well, you're back to 1FA That can be fine if that's what you want, but if you wanted 2FA: - FreeOTP: https://f-droid.org/packages/org.fedorahosted.freeotp - someone forked that and calle…

> If you use oathtool on your laptop, and the password is stored there as well, you're back to 1FA

This is trivially true, but also misses some nuance. Not all "1FA" is created equal. A leaked password can be used by any bad actor remotely who has never met you.

Also your computer could itself have a password and disk encryption, so someone who stole it would still need 2 factors: something you have (your physical laptop) + something you know (laptop password).

Regardless, TOTP is not phishing resistant, so I do tend to prefer passkeys but I understand they're problematic in terms of losing access to the devices/clouds with passkeys stored and then what do you do? (Sometimes services have an out-of-band process to prove identity and reset passkeys, but not all do)

Re: De-Googling TOTP Authenticator Codes

#99

Post by catlikesshrimp » Mon, Sep 01, 2025, 3:45 PM UTC

I love the post. I know this is not the topic: There is a google-auth replacement which has appropiate qr scanning and doesn't require any connection permission, in f-droid. I don't know why freeOTP is more popular since it asks for full network permission.

https://fxedel.gitlab.io/fdroid-website/en/packages/org.shad...

andOTP.

Re: De-Googling TOTP Authenticator Codes

#100

Post by butz » Mon, Sep 01, 2025, 3:50 PM UTC

The worst offender in 2FA business is Steam, as it uses custom 2FA and you must install their app - no way to use 3rd party OTP without jumping through hoops and risking security.