> But here we\u2019re focusing on apps like Google Authenticator that use something called TOTP algorithm.
> What we want to achieve is understand how apps like Google Authenticator (or any other TOTP app) are solving that?","title":null,"type":"comment","url":null},{"author":"ocdtrekkie","children":[{"author":"loloquwowndueo","children":[{"author":"tinus_hn","children":[{"author":"nanidin","children":[{"author":"greggman3","children":[],"created_at":"2021-08-28T18:24:10.000Z","created_at_i":1630175050,"id":28340289,"options":[],"parent_id":28336066,"points":null,"story_id":28324626,"text":"Thanks! I hadn't seen that feature. Just checked it out. It shows multiple QR codes (in my case 2 QR codes which contain 11 TOTPs total) that you can scan from another device running Google Authenticator to transfer to codes. I guess I can screenshot those QR goes to back up (scary)","title":null,"type":"comment","url":null}],"created_at":"2021-08-28T06:29:58.000Z","created_at_i":1630132198,"id":28336066,"options":[],"parent_id":28331679,"points":null,"story_id":28324626,"text":"Google Authenticator has a feature to allow export of all saved codes into one QR code for re-import into Google Authenticator running on another device. I printed a copy of my export QR code for use in case my device is lost or stolen.","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T18:57:46.000Z","created_at_i":1630090666,"id":28331679,"options":[],"parent_id":28331601,"points":null,"story_id":28324626,"text":"Also Google Authenticator does not allow you to include your codes in your backup, even when it\u2019s encrypted. So due to Google Authenticator, losing your 2fa codes is an expected problem and many companies allow you to reset it by simply calling them.
It sounds really secure but it really is not.","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T18:50:49.000Z","created_at_i":1630090249,"id":28331601,"options":[],"parent_id":28331513,"points":null,"story_id":28324626,"text":"Back in the day it was the best-known and most reliably available cross-platform (iOS, android) code generator - so many sites just assume it as a de facto standard. It also reduces support burden to tell people this is the officially supported code generator, that way you don\u2019t need to struggle understanding why a random app might be having trouble with codes.
These days it\u2019s much less of an issue as there are many more clients - the IdP I manage now mentions authy, tofu and 1password as also supported.","title":null,"type":"comment","url":null},{"author":"animex","children":[{"author":"filoleg","children":[{"author":"isbvhodnvemrwvn","children":[{"author":"akersten","children":[{"author":"unclebucknasty","children":[],"created_at":"2021-08-27T21:06:08.000Z","created_at_i":1630098368,"id":28332968,"options":[],"parent_id":28332859,"points":null,"story_id":28324626,"text":">Can I print that QR code and stuff it in a safe to scan 3 years from now, or does it expire?
Given the protocol/algorithm, it shouldn't expire.","title":null,"type":"comment","url":null},{"author":"remus","children":[],"created_at":"2021-08-27T21:11:37.000Z","created_at_i":1630098697,"id":28333021,"options":[],"parent_id":28332859,"points":null,"story_id":28324626,"text":"I'm pretty sure the QR codes actually encode your secrets so if you want to print them out you're good to go. Obviously won't include any new ones you add in in the meantime though.","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T20:53:26.000Z","created_at_i":1630097606,"id":28332859,"options":[],"parent_id":28332802,"points":null,"story_id":28324626,"text":"Can I print that QR code and stuff it in a safe to scan 3 years from now, or does it expire? It isn't clear from the export screen.","title":null,"type":"comment","url":null},{"author":"filoleg","children":[{"author":"nemetroid","children":[],"created_at":"2021-08-27T23:46:44.000Z","created_at_i":1630108004,"id":28334227,"options":[],"parent_id":28333036,"points":null,"story_id":28324626,"text":"That doesn't make much sense to me. If the app has the state necessary to generate TOTP codes, why couldn't it transfer that state to a different device? How could it be dependent on the service?","title":null,"type":"comment","url":null},{"author":"nl","children":[],"created_at":"2021-08-28T00:45:57.000Z","created_at_i":1630111557,"id":28334542,"options":[],"parent_id":28333036,"points":null,"story_id":28324626,"text":"This isn't the case.
I recently changed phones from Android to iOS and the export/import from Google Authenticator was fine for non-Google services.
Edit: I think there was a bug where it seemed to only export the tokens visible on the page, so I had to scroll and do it again for additional tokens. Maybe you are hitting that.","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T21:15:09.000Z","created_at_i":1630098909,"id":28333036,"options":[],"parent_id":28332802,"points":null,"story_id":28324626,"text":"This is only for Google-specific services that use 2FA (and it works with any authenticator apps, not just Google Authenticator, because this functionality is dependent on the service, not the app).
So if I try to do this for my Google account 2FA (with Google Authenticator, Microsoft Authenticator, or literally any other authenticator app), it works. But it won\u2019t work for any of my other 2FA accounts, like MSFT, Discord, etc., no matter which authenticator app I use.
To your defense, Google Authenticator added the option for restoring from local backup fairly recently, but only for Android. And even then, no ability to sync it with multiple devices.","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T20:47:06.000Z","created_at_i":1630097226,"id":28332802,"options":[],"parent_id":28332422,"points":null,"story_id":28324626,"text":"Google Authenticator has added account transfer at some point in the recent couple years - you get a QR code that you can scan on another device to transfer stuff. It's not automated backup, but it makes migration to new devices easier.","title":null,"type":"comment","url":null},{"author":"koolba","children":[{"author":"filoleg","children":[],"created_at":"2021-08-27T21:21:22.000Z","created_at_i":1630099282,"id":28333085,"options":[],"parent_id":28332886,"points":null,"story_id":28324626,"text":"It isn\u2019t \u201cthe same cloud\u201d that you were talking about, it is iCloud.","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T20:56:41.000Z","created_at_i":1630097801,"id":28332886,"options":[],"parent_id":28332422,"points":null,"story_id":28324626,"text":"> Microsoft Authenticator solves both of those problems, as they have recently (less than a year ago iirc) added a \u201cbackup to cloud\u201d feature.
Is this to the same cloud that Microsoft gives unfettered access to all its customer\u2019s Cosmos DB data?
2FA backups are fine but they need to be onto local, offline, disks. Automated cloud backups that can be decrypted at rest are no longer \u201csomething only you have\u201d.","title":null,"type":"comment","url":null},{"author":"JumpCrisscross","children":[{"author":"filoleg","children":[{"author":"JumpCrisscross","children":[{"author":"greggman3","children":[{"author":"JumpCrisscross","children":[],"created_at":"2021-08-28T20:16:45.000Z","created_at_i":1630181805,"id":28341147,"options":[],"parent_id":28340228,"points":null,"story_id":28324626,"text":"Settings->User->iCloud->Manage Storage->Backups.","title":null,"type":"comment","url":null},{"author":"filoleg","children":[],"created_at":"2021-08-31T16:28:01.000Z","created_at_i":1630427281,"id":28370041,"options":[],"parent_id":28340228,"points":null,"story_id":28324626,"text":"Exact same experience. The app backs up into icloud and gets restored on backup restore just fine. But no 2FA codes are present after restoring, so I had to enter them manually.","title":null,"type":"comment","url":null}],"created_at":"2021-08-28T18:19:27.000Z","created_at_i":1630174767,"id":28340228,"options":[],"parent_id":28333166,"points":null,"story_id":28324626,"text":"Are you sure this actually works?
My understanding is that iCloud backup is specified by the user per app (can default to on). Going into my iPhone->Settings->Authenticator there are no iCloud settings and iPhone->Settings->iCloud shows lots of apps but Authenticator is not one of them.
I have iCloud backup on, have switched through at least 2 phones (as in 6+->10->11) where I have Google Authenticator on. The new phone never had any of the Authenticator codes after restoring yet all the other apps restored their data.","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T21:28:28.000Z","created_at_i":1630099708,"id":28333166,"options":[],"parent_id":28333028,"points":null,"story_id":28324626,"text":"> I just opened Google Authenticator on iOS, and it isn\u2019t an option
Why would it be an option in the app? Go to your phone's backup settings and select Google Authenticator. When I had this on, it worked. (It might have since changed.)
Google being Google, there is zero reliable documentation on anything, but here's a community thing from a few years ago [1].
[1] https://support.google.com/mail/forum/AAAAK7un8RUcSLd5H1MpO4...","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T21:13:42.000Z","created_at_i":1630098822,"id":28333028,"options":[],"parent_id":28332974,"points":null,"story_id":28324626,"text":"> On iOS, you can back up Google Authenticator. It then restores with your 2FA codes intact.
Source needed. I just opened Google Authenticator on iOS, and it isn\u2019t an option. Googling confirmed that it isn\u2019t supported on iOS.
If you try to restore the phone from the backup (whether iCloud or local backup), it will restore the app, but it will have no 2FA codes present.","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T21:06:42.000Z","created_at_i":1630098402,"id":28332974,"options":[],"parent_id":28332422,"points":null,"story_id":28324626,"text":"> If i store my 2FA in google authenticator and something happens to my phone? I am in a world of serious pain
On iOS, you can back up Google Authenticator. It then restores with your 2FA codes intact. (I don't do this, because I feel it weakness 2FA's security and am decent about saving recovery codes. But everyone's tolerance for B.S. is different.)","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T20:05:59.000Z","created_at_i":1630094759,"id":28332422,"options":[],"parent_id":28331732,"points":null,"story_id":28324626,"text":"For me personally, Microsoft Authenticator started ruling as well recently, after 5+ years with Google Authenticator. Why? I have already mentioned it in other comments before, and it is due to Google\u2019s insistence on not implementing recovery from backup.
If i store my 2FA in google authenticator and something happens to my phone? I am in a world of serious pain. If i upgrade phones? I have to disable and re-enable 2FA on my new phone manually for every single service I use.
Microsoft Authenticator solves both of those problems, as they have recently (less than a year ago iirc) added a \u201cbackup to cloud\u201d feature. No more stressing about something happening to my phone, as long as i have my (single) primary recovery key stored on a piece of paper somewhere safe (as opposed to having a paper recovery key for every 2fa service i use).
Prior to this, i was seriously considering getting a cheap backup phone to which i set up all the 2fa codes simultaneously with my main phone, then put that cheap phone in a bank cell/safe/etc., and then rely on it in case something happens to my main phone. That would still not solve the problem of manual transfer and disabling/re-enabling 2fa for every single service, but that would be much better than losing the device.
Note: I know Authy exists and had this functionality of cloud syncing 2FA keys between logged in devices for years, but for some irrational reason i was sticking with the \u201csimpler is better, and i somehow trust google more with this one\u201d, but luckily, I trust MSFT with my 2FA no less than i would google, perhaps even moreso. And the biometric 2FA for services that support it (so far, I\u2019ve only seen it used with certain corporate MSFT services) are a nice cherry on top.","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T19:02:58.000Z","created_at_i":1630090978,"id":28331732,"options":[],"parent_id":28331513,"points":null,"story_id":28324626,"text":"In Fortune 1000 land, Microsoft Authenticator rules the land. I love it because most have implemented notification push-authentication with biometric verification. Some sites will use that in lieu of any password at all.
The worst is when separate apps & companies roll their own authenticator app.","title":null,"type":"comment","url":null},{"author":"tialaramex","children":[{"author":"jaywalk","children":[{"author":"greggman3","children":[],"created_at":"2021-08-28T18:26:44.000Z","created_at_i":1630175204,"id":28340305,"options":[],"parent_id":28332473,"points":null,"story_id":28324626,"text":"I'm a little surprised Google hasn't don't this but I guess they have give gmail. Sign into google and it will ask me to approve on my gmail app.
Not entirely sure I like these "authenticate on from another device". Just yesterday I mis-placed my phone. I wanted to sign into iCloud.com for use "find my phone" feature from my PC. It required me to use apple's authentication via a code sent to the phone, the exact thing I was looking for! :(","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T20:12:03.000Z","created_at_i":1630095123,"id":28332473,"options":[],"parent_id":28332182,"points":null,"story_id":28324626,"text":"Microsoft Authenticator is more than just TOTP, which is why it wants a Microsoft account. It also supports push approvals.","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T19:43:09.000Z","created_at_i":1630093389,"id":28332182,"options":[],"parent_id":28331513,"points":null,"story_id":28324626,"text":"Microsoft's stuff all wants you to install the Microsoft Authenticator which needs a Microsoft account for some reason and that (for me anyway) then immediately wanted me to setup 2FA, for which it required me to install the Microsoft Authenticator, which ... you can see how that goes.
As I began to experience D\u00e9j\u00e0 vu on the first day of a new job I snapped out of it, removed the Microsoft Authenticator and told it nah, I'm OK actually, show me that QR code for "other authenticators" and never looked back.","title":null,"type":"comment","url":null},{"author":"ezekg","children":[],"created_at":"2021-08-27T20:20:50.000Z","created_at_i":1630095650,"id":28332575,"options":[],"parent_id":28331513,"points":null,"story_id":28324626,"text":"I'm not sure why you're being down voted, but I agree. I've had several discussions where people think Authy is incompatible with sites that prompt for Google Authenticator, like it's some special more-secure TOTP app.","title":null,"type":"comment","url":null},{"author":"unclebucknasty","children":[{"author":"fraa-orolo","children":[],"created_at":"2021-08-27T22:48:14.000Z","created_at_i":1630104494,"id":28333792,"options":[],"parent_id":28332920,"points":null,"story_id":28324626,"text":"Have you seen users? I have to convince users not to install random crap.","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T21:00:40.000Z","created_at_i":1630098040,"id":28332920,"options":[],"parent_id":28331513,"points":null,"story_id":28324626,"text":"It's about the perception of security and reducing friction. Everyone knows Google, so you don't have to convince users of the trustworthiness of a lesser-known brand or open source project within the sensitive context of increasing security.","title":null,"type":"comment","url":null},{"author":"pilsetnieks","children":[],"created_at":"2021-08-27T22:46:32.000Z","created_at_i":1630104392,"id":28333780,"options":[],"parent_id":28331513,"points":null,"story_id":28324626,"text":"On the one hand, I agree but on the other, this is the one case where you cannot take any chance of having your user install some random dodgy app that promises the same functionality.","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T18:42:40.000Z","created_at_i":1630089760,"id":28331513,"options":[],"parent_id":28331198,"points":null,"story_id":28324626,"text":"It's truly and deeply frustrating to me how many sites and services push "Google Authenticator" branding instead of specifying that it's TOTP or that literally any good 2FA app will work. It's almost to that "Google" = "search" level, but for a more niche aspect.","title":null,"type":"comment","url":null},{"author":"willis936","children":[{"author":"Godel_unicode","children":[{"author":"willis936","children":[{"author":"maxerickson","children":[{"author":"willis936","children":[],"created_at":"2021-08-27T23:02:20.000Z","created_at_i":1630105340,"id":28333929,"options":[],"parent_id":28333308,"points":null,"story_id":28324626,"text":"Yeah but a key without a second factor (something you know) is still better than a key. Just make sure your password isn't brute forceable.","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T21:46:52.000Z","created_at_i":1630100812,"id":28333308,"options":[],"parent_id":28333283,"points":null,"story_id":28324626,"text":"They key doesn't particularly increase the security of the authentication, but it helps a bit if you lose control of the device the db is stored on.","title":null,"type":"comment","url":null},{"author":"Godel_unicode","children":[],"created_at":"2021-08-27T23:13:47.000Z","created_at_i":1630106027,"id":28334016,"options":[],"parent_id":28333283,"points":null,"story_id":28324626,"text":"Firstly, while that's technically correct according to the CISSP, it's obviously not actually correct. Two different things I have can absolutely be two factors as long as they are not susceptible to the same method of compromise. 1+1=2.
Secondly, many password vaults refer to the master password you use to unlock it as the key.
Thirdly, many security keys require a pin or similar to be used.","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T21:43:46.000Z","created_at_i":1630100626,"id":28333283,"options":[],"parent_id":28332892,"points":null,"story_id":28324626,"text":"What's the point of using a key? That doesn't add a second factor of authentication. Something you have and something else you have is 1FA.
A password with more than 200 bits of entropy seems reasonable.","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T20:57:28.000Z","created_at_i":1630097848,"id":28332892,"options":[],"parent_id":28331961,"points":null,"story_id":28324626,"text":"An adversary still has to get the manager DB and the key to unlock it (your password manager DB is encrypted with a key, right?).","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T19:24:28.000Z","created_at_i":1630092268,"id":28331961,"options":[],"parent_id":28331198,"points":null,"story_id":28324626,"text":"You can even convert TOTP from 2FA into 1.5ish FA by using a password manager that stores the TOTP secret and generates the TOTP key from it.","title":null,"type":"comment","url":null},{"author":"tshaddox","children":[{"author":"easton","children":[],"created_at":"2021-08-27T20:43:32.000Z","created_at_i":1630097012,"id":28332769,"options":[],"parent_id":28332078,"points":null,"story_id":28324626,"text":"There is still a little bit of a point, as it guarantees the password came out of 1Password and wasn't from somewhere else. If someone screencapped your password out of 1Password, it wouldn't of use unless they could get into your vault somehow.","title":null,"type":"comment","url":null},{"author":"jeromegv","children":[{"author":"tialaramex","children":[{"author":"bdamm","children":[],"created_at":"2021-08-28T03:07:47.000Z","created_at_i":1630120067,"id":28335287,"options":[],"parent_id":28333015,"points":null,"story_id":28324626,"text":"WebAuthn is great. Put it to work recently in a new control system and it sure is a nice feeling to deploy with zero need for passwords.","title":null,"type":"comment","url":null},{"author":"brokenmachine","children":[],"created_at":"2021-08-30T03:54:06.000Z","created_at_i":1630295646,"id":28352673,"options":[],"parent_id":28333015,"points":null,"story_id":28324626,"text":"I had a quick look on wikipedia about how webauthn works, looks like you use a hardware (USB?) device to sign something with the PIN you enter.
What happens if you lose that device, or if it fails?","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T21:11:07.000Z","created_at_i":1630098667,"id":28333015,"options":[],"parent_id":28332938,"points":null,"story_id":28324626,"text":"Depending on the leak, the secret that drives TOTP could also be in the same database table (or a nearby one). This means anybody with that secret can trivially run the TOTP algorithm and get the correct six digit code for any time present or future.
If you care about MFA that can survive leaks, you want WebAuthn. As with phishing this known problem was considered in the design of WebAuthn and so your WebAuthn credentials aren't designed to need to be secret.
In fact here you go, here are WebAuthn credentials for a vanity system I own, copied out of its authentication database:
ID: AXnUJ920FfJlRjZtocN+9Bc9IP6gvsBiWA3GfJxckh3nQ/KekQ6xB2byfI2GM7IcGS2MpzxZs6IHmAxvgAcE/Mw=\nPublic key: pQECAyYgASFYIFf0iDSfNpYNA5Br9zXSIUH69BqyvFcgbqy6tWC8rsLwIlggCDqury9UOzI1DnOFyE3aYwaBLvP0NyNez98v0TcieKs=
That's all the backend needs to check I'm really me, and yet it's also completely useless to an attacker, they can't even use it to compare across sites and "unmask" me.","title":null,"type":"comment","url":null},{"author":"tshaddox","children":[],"created_at":"2021-08-27T22:54:30.000Z","created_at_i":1630104870,"id":28333862,"options":[],"parent_id":28332938,"points":null,"story_id":28324626,"text":"If they stored my password in plain text, I'm not sure I would trust their 2FA implementation to actually function as a second factor to protect my account. :) Seriously though, isn't this a little like saying that a website could have two passwords on each account so if they suffer a data leak that happens to leak only one of your passwords, that wouldn't be enough to access your account?","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T21:02:59.000Z","created_at_i":1630098179,"id":28332938,"options":[],"parent_id":28332078,"points":null,"story_id":28324626,"text":"If your passwords are leaked in a data leak, they still wouldn't get your 2FA. So I wouldn't say it entirely defeats the purpose of 2FA.","title":null,"type":"comment","url":null},{"author":"temp0826","children":[{"author":"deepspace","children":[],"created_at":"2021-08-28T00:03:09.000Z","created_at_i":1630108989,"id":28334318,"options":[],"parent_id":28334245,"points":null,"story_id":28324626,"text":"Yes. Of course, you need to be logged in on another device to do that.","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T23:50:22.000Z","created_at_i":1630108222,"id":28334245,"options":[],"parent_id":28332078,"points":null,"story_id":28324626,"text":"Can you use 1password to act as the code generator for logging in to 1password?","title":null,"type":"comment","url":null},{"author":"lysp","children":[{"author":"leshenka","children":[{"author":"tiddles","children":[],"created_at":"2021-08-28T06:58:17.000Z","created_at_i":1630133897,"id":28336162,"options":[],"parent_id":28335924,"points":null,"story_id":28324626,"text":"Sounds like they're doing it properly then!","title":null,"type":"comment","url":null}],"created_at":"2021-08-28T05:46:02.000Z","created_at_i":1630129562,"id":28335924,"options":[],"parent_id":28335436,"points":null,"story_id":28324626,"text":"That's like the definition of 2FA/MFA","title":null,"type":"comment","url":null}],"created_at":"2021-08-28T03:37:23.000Z","created_at_i":1630121843,"id":28335436,"options":[],"parent_id":28332078,"points":null,"story_id":28324626,"text":"I actually do the opposite.
Keep passwords on browser, and MFA on phone.
If my browser / desktop got compromised, someone would still need my phone to access my accounts.","title":null,"type":"comment","url":null},{"author":"agret","children":[{"author":"beermonster","children":[{"author":"Abishek_Muthian","children":[],"created_at":"2021-08-31T17:23:41.000Z","created_at_i":1630430621,"id":28370874,"options":[],"parent_id":28336316,"points":null,"story_id":28324626,"text":"Isn't it just one time export which by function of TOTP is synced and not an actual sync like in 1Password? i.e. Only the accounts which were available when you exported would be there in another device.","title":null,"type":"comment","url":null}],"created_at":"2021-08-28T07:37:29.000Z","created_at_i":1630136249,"id":28336316,"options":[],"parent_id":28335970,"points":null,"story_id":28324626,"text":"Google Authenticator allows you to sync passwords between devices these days. Fairly recent(ish) and long overdue update.","title":null,"type":"comment","url":null}],"created_at":"2021-08-28T05:59:19.000Z","created_at_i":1630130359,"id":28335970,"options":[],"parent_id":28332078,"points":null,"story_id":28324626,"text":"I use LastPass for password sync and Authy for 2FA. Feels a bit safer having them seperate.","title":null,"type":"comment","url":null},{"author":"tomesco","children":[],"created_at":"2021-08-28T06:46:33.000Z","created_at_i":1630133193,"id":28336124,"options":[],"parent_id":28332078,"points":null,"story_id":28324626,"text":"1Password had a blog post [1] addressing this concern. Essentially you still have the benefit of one-timeness, but not second factor, and need to compare that to what your security needs are.
[1] https://blog.1password.com/totp-for-1password-users/","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T19:34:34.000Z","created_at_i":1630092874,"id":28332078,"options":[],"parent_id":28331198,"points":null,"story_id":28324626,"text":"I use 1Password for all of my MFA codes on the web. It's extremely convenient to have them synced across all my devices, but I can't help but think that having my passwords and my MFA private keys stored in the same place almost entirely defeats the purpose of multi-factor authentication.","title":null,"type":"comment","url":null},{"author":"kaladin-jasnah","children":[{"author":"teekert","children":[{"author":"commoner","children":[{"author":"AnonC","children":[{"author":"commoner","children":[],"created_at":"2021-08-28T15:44:06.000Z","created_at_i":1630165446,"id":28338941,"options":[],"parent_id":28338088,"points":null,"story_id":28324626,"text":"You're 100% right. Raivo is source-available, but not free (libre) or open source. I found it through a forum post and neglected to check the license.","title":null,"type":"comment","url":null}],"created_at":"2021-08-28T13:57:18.000Z","created_at_i":1630159038,"id":28338088,"options":[],"parent_id":28333525,"points":null,"story_id":28324626,"text":"To add something about this app, I know that people understand \u201copen source\u201d to mean different things. In the case of Raivo, the app is a \u201csource available\u201d one. It\u2019s not FOSS.
The license [1] says:
> Modification, duplication or distribution of this Service (in source and binary forms) for any purpose is strictly prohibited.
[1]: https://github.com/raivo-otp/ios-application/blob/master/LIC...","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T22:12:04.000Z","created_at_i":1630102324,"id":28333525,"options":[],"parent_id":28333147,"points":null,"story_id":28324626,"text":"Raivo is an iOS TOTP authenticator that is open source and supports exports. Hopefully, this is what you're looking for:
https://apps.apple.com/us/app/raivo-otp/id1459042137
https://github.com/raivo-otp/ios-application","title":null,"type":"comment","url":null},{"author":"jumhyn","children":[{"author":"teekert","children":[{"author":"jumhyn","children":[],"created_at":"2021-08-28T16:34:55.000Z","created_at_i":1630168495,"id":28339344,"options":[],"parent_id":28339030,"points":null,"story_id":28324626,"text":"On iOS each password item in Settings.app has a "Share" button that lets you AirDrop to another device. I don't see another way to export from iOS.
Safari on macOS (at least in Monterey) offers a bulk export option, which can export all your passwords to an unencrypted CSV file. The information includes URL, username/email, password, and an "OTPAuth" column. For GitHub (the only account I've enabled native TOTP for while the feature is still in beta) the entry in that column looks like this:
> otpauth://totp/github.com:<username>?secret=<secret>&issuer=github.com&algorithm=SHA1&digits=6&period=30
So I'm not sure if that would be directly importable to another service, but at the very least you get the secret and so could transfer the data account-by-account if you had to.","title":null,"type":"comment","url":null}],"created_at":"2021-08-28T15:54:20.000Z","created_at_i":1630166060,"id":28339030,"options":[],"parent_id":28334552,"points":null,"story_id":28324626,"text":"Will I be able to export? When I moved to iOS, AndOTP saved me because I could copy paste all personal keys from AndOTP to MS authenticator. This will probably lock me in\u2026","title":null,"type":"comment","url":null},{"author":"asiachick","children":[{"author":"jumhyn","children":[],"created_at":"2021-08-28T20:29:02.000Z","created_at_i":1630182542,"id":28341240,"options":[],"parent_id":28340098,"points":null,"story_id":28324626,"text":"May not make a difference if you don\u2019t take Apple at their word but iCloud Keychain is among the services/data encrypted end-to-end[1] and there\u2019s no exception mentioned for iCloud backup (like there is for Messages).
[1]: https://support.apple.com/en-us/HT202303","title":null,"type":"comment","url":null}],"created_at":"2021-08-28T18:04:43.000Z","created_at_i":1630173883,"id":28340098,"options":[],"parent_id":28334552,"points":null,"story_id":28324626,"text":"given Apple's new spying stance I'm not sure I want to allow the to store my passwords","title":null,"type":"comment","url":null}],"created_at":"2021-08-28T00:49:07.000Z","created_at_i":1630111747,"id":28334552,"options":[],"parent_id":28333147,"points":null,"story_id":28324626,"text":"FWIW, iOS 15 lets you put a TOTP secret right into the saved password entry on your phone, and it will autofill the code just like it autofills your password.","title":null,"type":"comment","url":null},{"author":"artificialLimbs","children":[],"created_at":"2021-08-28T05:56:46.000Z","created_at_i":1630130206,"id":28335959,"options":[],"parent_id":28333147,"points":null,"story_id":28324626,"text":"There is Tofu. It doesn't export, but it does back up to iCloud, fwiw.
https://www.tofuauth.com/","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T21:26:34.000Z","created_at_i":1630099594,"id":28333147,"options":[],"parent_id":28332978,"points":null,"story_id":28324626,"text":"AndOTP is really nice. It is the one thing I miss on iOS. On iOS there does not seem to be any totp apps that can just export their db as an encrypted file (or unencrypted if you so choose). So in Apple land I\u2019m stuck with MS Authenticator, coincidentally my only app that needs iCloud (I really want it backed up).","title":null,"type":"comment","url":null},{"author":"slim","children":[],"created_at":"2021-08-27T22:03:55.000Z","created_at_i":1630101835,"id":28333457,"options":[],"parent_id":28332978,"points":null,"story_id":28324626,"text":"My favorite is Android Token because it's only 67 kb and it has everything including qrcode scanning :) check it on fdroid","title":null,"type":"comment","url":null},{"author":"rraghur","children":[{"author":"stavros","children":[],"created_at":"2021-08-28T08:12:26.000Z","created_at_i":1630138346,"id":28336458,"options":[],"parent_id":28335717,"points":null,"story_id":28324626,"text":"Seconding Aegis, it's great.","title":null,"type":"comment","url":null},{"author":"circularfoyers","children":[],"created_at":"2021-08-28T18:10:48.000Z","created_at_i":1630174248,"id":28340149,"options":[],"parent_id":28335717,"points":null,"story_id":28324626,"text":"andOTP does all of that too and was out before Aegis. What does it have over andOTP?","title":null,"type":"comment","url":null}],"created_at":"2021-08-28T04:50:27.000Z","created_at_i":1630126227,"id":28335717,"options":[],"parent_id":28332978,"points":null,"story_id":28324626,"text":"Mine is aegis.. it's on f droid, completely open source, let's you backup your secrets so changing phones isn't a pita","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T21:06:59.000Z","created_at_i":1630098419,"id":28332978,"options":[],"parent_id":28331198,"points":null,"story_id":28324626,"text":"Have to chime in but my favourite authenticator is andOTP. Seems to be FOSS as well since it's on F-Droid[0] and I hear it has good support from migration from one phone/ROM to another.
[0] https://f-droid.org/en/packages/org.shadowice.flocke.andotp/","title":null,"type":"comment","url":null},{"author":"judge2020","children":[],"created_at":"2021-08-27T22:53:34.000Z","created_at_i":1630104814,"id":28333849,"options":[],"parent_id":28331198,"points":null,"story_id":28324626,"text":"Unfortunately, Stripe does this currently: https://i.judge.sh/youthful/Derpy/chrome_TIDNqlcRvI.png","title":null,"type":"comment","url":null},{"author":"jvanderbot","children":[{"author":"stevekemp","children":[{"author":"jvanderbot","children":[],"created_at":"2021-08-28T15:40:16.000Z","created_at_i":1630165216,"id":28338891,"options":[],"parent_id":28335949,"points":null,"story_id":28324626,"text":"Great tip thanks!","title":null,"type":"comment","url":null}],"created_at":"2021-08-28T05:55:29.000Z","created_at_i":1630130129,"id":28335949,"options":[],"parent_id":28334733,"points":null,"story_id":28324626,"text":"If you're using pass already you could use their OTP plugin:
https://github.com/tadfisher/pass-otp
That gives you "pass otp github.com", etc. You can also export the QRcode, and do similar things.
I put together a simple distribution of pass with a couple of plugins I use, including otp, which is easy to setup - just clone beneath `/opt/pass`:
https://github.com/skx/pass","title":null,"type":"comment","url":null}],"created_at":"2021-08-28T01:23:24.000Z","created_at_i":1630113804,"id":28334733,"options":[],"parent_id":28331198,"points":null,"story_id":28324626,"text":"You can use oathtool if you'd like to "do it yourself". I usually just keep (encrypted with Pass) my secret keys for Authenticators, and execute a one line alias:
oathtool -b --totp `pass show <X>`
... for <X> in github, gmail, blizzard, whatever ...
This way, you can have a backup in case your phone gets lost, and easily port between phones.","title":null,"type":"comment","url":null},{"author":"werid","children":[],"created_at":"2021-08-28T06:26:08.000Z","created_at_i":1630131968,"id":28336053,"options":[],"parent_id":28331198,"points":null,"story_id":28324626,"text":"at one point i used a python script to provide a totp response to google when using youtube-dl (before logging in became broken and had to switch to cookies)
![https://i.judge.sh/youthful/Derpy/chrome_TIDNqlcRvI.png](\"https://i.judge.sh/youthful/Derpy/chrome_TIDNqlcRvI.png\"){kind=link}
import onetimepass as otp\n my_secret = '' \n my_token = otp.get_totp(my_secret) \n print my_tokenYou need a library like that and a way to convert an otp:// url into a QR code, for which there are many libaries as well. The rest is just implementing a sane UX around this. Storing the user's TOTP secret server side is a bit tricky. I suspect a plain text field in a database is quite common for this; which of course would be disastrous if that database were ever stolen. Secret stores don't scale for this as they tend to be designed for just a handful of secrets. We ended up encrypting these totp secrets using a key from our secret store.","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T18:14:37.000Z","created_at_i":1630088077,"id":28331198,"options":[],"parent_id":28324626,"points":null,"story_id":28324626,"text":"Google Authenticator is an implementation of the catchily-named "Time-based One-Time Password" or TOTP.
https://en.wikipedia.org/wiki/Time-based_One-Time_Password
It is not the only one, any time a site asks you to add a "Google Authenticator" code you can use any TOTP app. 1Password has the functionality built in, for example.","title":null,"type":"comment","url":null},{"author":"seanwilson","children":[{"author":"pgalvin","children":[],"created_at":"2021-08-27T18:35:11.000Z","created_at_i":1630089311,"id":28331432,"options":[],"parent_id":28331356,"points":null,"story_id":28324626,"text":"This is mostly a non-issue - services usually accept the current, previous and next TOTP code to account for devices having a slightly incorrect clock.
I\u2019ve never had an Android device that keeps its clock in sync, for example, so they had to address this.","title":null,"type":"comment","url":null},{"author":"b3morales","children":[],"created_at":"2021-08-27T18:35:58.000Z","created_at_i":1630089358,"id":28331447,"options":[],"parent_id":28331356,"points":null,"story_id":28324626,"text":"The server sides are typically set up with some flexibility to account for the latency and avoid this UX issue. They will have a window to accept the previous/next code even after the new becomes active.
To avoid replays, though, this should be reset once a code is accepted: only subsequent codes should be accepted afterwards.
So when code N is the "correct" code, any of N-1, N, or N+1 will be accepted. But if N is entered, only N+1 and onwards should be accepted for later attempts.","title":null,"type":"comment","url":null},{"author":"anchpop","children":[],"created_at":"2021-08-27T18:37:05.000Z","created_at_i":1630089425,"id":28331461,"options":[],"parent_id":28331356,"points":null,"story_id":28324626,"text":"I\u2019ve thought about that too. It should always show two codes (the current one and the previous one), and websites should accept both. Then when you open the app, you can always start typing the most recent one and have at least the whole interval to type it in","title":null,"type":"comment","url":null},{"author":"kccqzy","children":[],"created_at":"2021-08-27T18:38:00.000Z","created_at_i":1630089480,"id":28331470,"options":[],"parent_id":28331356,"points":null,"story_id":28324626,"text":"Servers generally have no problem accepting an expired code, if the code is only expired for a few seconds.","title":null,"type":"comment","url":null},{"author":"pmlamotte","children":[],"created_at":"2021-08-27T18:47:04.000Z","created_at_i":1630090024,"id":28331558,"options":[],"parent_id":28331356,"points":null,"story_id":28324626,"text":"Showing two codes would definitely be a nice opt-in feature. Servers generally will compute codes within a sliding window to account for time sync discrepancies so there wouldn't be much harm. I could see how it may be confusing to some end users though.","title":null,"type":"comment","url":null},{"author":"ecesena","children":[{"author":"JyB","children":[{"author":"ecesena","children":[],"created_at":"2021-08-28T04:27:16.000Z","created_at_i":1630124836,"id":28335628,"options":[],"parent_id":28332855,"points":null,"story_id":28324626,"text":"> Could it not show the next code [...] ?
Codes are typically valid for 3-5min [...] just use the current code even if it seems expired","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T20:53:18.000Z","created_at_i":1630097598,"id":28332855,"options":[],"parent_id":28332017,"points":null,"story_id":28324626,"text":"Not sure how that's relevant to the parent.","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T19:29:56.000Z","created_at_i":1630092596,"id":28332017,"options":[],"parent_id":28331356,"points":null,"story_id":28324626,"text":"Codes are typically valid for 3-5min even if the display only shows 1min. This is to avoid issues with time discrepancy on client/server, and doesn't really make a big difference in terms of security, feel free to try it out.
So, to fix your issue, just use the current code even if it seems expired.
As a side note, it's important to enforce that each code can only be used once. Authy (the server-side service) does that, but many "roll your own" TOTP solutions don't verify this.","title":null,"type":"comment","url":null},{"author":"tialaramex","children":[],"created_at":"2021-08-27T19:52:29.000Z","created_at_i":1630093949,"id":28332281,"options":[],"parent_id":28331356,"points":null,"story_id":28324626,"text":"A good implementation of this protocol remembers that it saw this code and won't let anybody re-use it. For example suppose I am standing behind Sarah as she logs in to her bank and I happen to already know that her "Favourite carebear" was "Birthday Bear" even though that's not displayed on screen, and I see she types 123 456 as the TOTP code.
If I am very quick and try to also log in to her bank with "Birthday Bear" and 123 456 that shouldn't work even though that's still the "right" code for the next few seconds. The bank login should tell me that I need to wait and enter the next code. I can't see Sarah's next code because she's done and put her phone away.
RFC 6238 says of this: "The verifier MUST NOT accept the second attempt of the OTP after the successful validation has been issued for the first OTP, which ensures one-time only use of an OTP."","title":null,"type":"comment","url":null},{"author":"JyB","children":[],"created_at":"2021-08-27T20:51:45.000Z","created_at_i":1630097505,"id":28332835,"options":[],"parent_id":28331356,"points":null,"story_id":28324626,"text":"Try it. They'll still work if the server side is implemented properly. The server will be lenient on the timestamps.","title":null,"type":"comment","url":null},{"author":"graftak","children":[],"created_at":"2021-08-29T07:55:11.000Z","created_at_i":1630223711,"id":28344984,"options":[],"parent_id":28331356,"points":null,"story_id":28324626,"text":"Raivo OTP for iOS does something similar where it displays the previous code (greyed out) too after it has expired. Convenient for when the time runs out while you enter the code, as others mentions there is often some leeway on the token expiry time.","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T18:28:19.000Z","created_at_i":1630088899,"id":28331356,"options":[],"parent_id":28324626,"points":null,"story_id":28324626,"text":"You know in Authy (Google Authenticator is similar here?) when there's only 10 seconds or so left to type in the current code so you wait for the next one to appear? Could it not show the next code instead if there wasn't much time left and the app you're authenticating with could accept the current or next code? Feels like an obvious annoyance that's fixable.","title":null,"type":"comment","url":null},{"author":"Donckele","children":[{"author":"duskwuff","children":[],"created_at":"2021-08-27T18:56:01.000Z","created_at_i":1630090561,"id":28331659,"options":[],"parent_id":28331552,"points":null,"story_id":28324626,"text":"That's pretty close to what they're doing, with some small changes (using HMAC, measuring the time in 30-second intervals, and generating a numeric code).","title":null,"type":"comment","url":null},{"author":"Jtsummers","children":[],"created_at":"2021-08-27T18:56:19.000Z","created_at_i":1630090579,"id":28331663,"options":[],"parent_id":28331552,"points":null,"story_id":28324626,"text":"One of the requirements for HOTP (which TOTP is based on) was that the code should be numeric for phone entry or similarly constrained entry mechanisms.
> R4 - The value displayed on the token MUST be easily read and entered by the user: This requires the HOTP value to be of reasonable length. The HOTP value must be at least a 6-digit value. It is also desirable that the HOTP value be 'numeric only' so that it can be easily entered on restricted devices such as phones.
See R4 at https://datatracker.ietf.org/doc/html/rfc4226 (split across pages 4 and 5).","title":null,"type":"comment","url":null},{"author":"cbdumas","children":[],"created_at":"2021-08-27T19:00:03.000Z","created_at_i":1630090803,"id":28331701,"options":[],"parent_id":28331552,"points":null,"story_id":28324626,"text":"With that scheme an attacker who gets access to a code (no matter how old) can then generate their own going forward. The hash function here means that even if someone obtains a code they can't generate other codes.","title":null,"type":"comment","url":null},{"author":"TimWolla","children":[{"author":"tshaddox","children":[],"created_at":"2021-08-27T19:37:04.000Z","created_at_i":1630093024,"id":28332120,"options":[],"parent_id":28331722,"points":null,"story_id":28324626,"text":"Don't all hashes start out as numbers anyway, before they get encoded as alphanumeric strings?","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T19:02:10.000Z","created_at_i":1630090930,"id":28331722,"options":[],"parent_id":28331552,"points":null,"story_id":28324626,"text":"One reason might be that those characters would include letters. A digits-only code is much easier to type, e.g. using a restricted keypad, such as a phone.","title":null,"type":"comment","url":null},{"author":"jjeaff","children":[],"created_at":"2021-08-27T19:03:46.000Z","created_at_i":1630091026,"id":28331742,"options":[],"parent_id":28331552,"points":null,"story_id":28324626,"text":"That's basically what they do. Most apps like Google authenticator use totp rather than hotp. The t stands for time, the h is hmac. Except they also use an algorithm to convert those characters to digits only. It's all described under the totp section.","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T18:46:18.000Z","created_at_i":1630089978,"id":28331552,"options":[],"parent_id":28324626,"points":null,"story_id":28324626,"text":"This could be a stupid question, why not just use the first few characters from the hash of the secret and the timestamp?","title":null,"type":"comment","url":null},{"author":"loloquwowndueo","children":[{"author":"Jtsummers","children":[],"created_at":"2021-08-27T18:53:20.000Z","created_at_i":1630090400,"id":28331628,"options":[],"parent_id":28331569,"points":null,"story_id":28324626,"text":"https://github.com/google/google-authenticator/wiki/Key-Uri-...
That's the format that gets encoded into the QR code. If you can decode the QR code you can get the secret key easily.","title":null,"type":"comment","url":null},{"author":"jmcphers","children":[],"created_at":"2021-08-27T18:54:18.000Z","created_at_i":1630090458,"id":28331642,"options":[],"parent_id":28331569,"points":null,"story_id":28324626,"text":"It's pretty easy to extract! zbarimg -q -raw <png> will do it.
http://manpages.ubuntu.com/manpages/bionic/man1/zbarimg.1.ht...","title":null,"type":"comment","url":null},{"author":"hannob","children":[],"created_at":"2021-08-27T18:55:07.000Z","created_at_i":1630090507,"id":28331648,"options":[],"parent_id":28331569,"points":null,"story_id":28324626,"text":"AFAIR there isn't much to "extract", you simply use any application that can decode the QR code and you get the key which is encoded as a sequence of letters and numbers.","title":null,"type":"comment","url":null},{"author":"composer","children":[],"created_at":"2021-08-27T19:32:17.000Z","created_at_i":1630092737,"id":28332043,"options":[],"parent_id":28331569,"points":null,"story_id":28324626,"text":"
oathtool -w1 --base32 --totp $secret\nAlso, no one should be using raw HMAC to do password checking. At the very least use something like PBKDF2.","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T18:56:58.000Z","created_at_i":1630090618,"id":28331670,"options":[],"parent_id":28324626,"points":null,"story_id":28324626,"text":"I found this part interesting:
> Notice that when the key is, say, 40 bytes long, it\u2019s padded with zeros to make it 64 bytes long. So the actual entropy of that key is equivalent to the 40-byte long key. But if the key is longer than 64 bytes, it\u2019s effectively being shortened to 20 bytes. So its entropy is lower. If you want to maximize the complexity of the key, and you\u2019re the one choosing the key, go for something around, but never more than, 64 bytes.
Perhaps that's why some sites have a maximum character limit for passwords. (Although I suspect many are just doing it wrong.)","title":null,"type":"comment","url":null},{"author":"codegeek","children":[{"author":"robertlagrant","children":[],"created_at":"2021-08-27T19:18:59.000Z","created_at_i":1630091939,"id":28331906,"options":[],"parent_id":28331847,"points":null,"story_id":28324626,"text":"Interesting! I didn't know that. Pretty handy for corporate stuff - keep the 2FA on the work computer.","title":null,"type":"comment","url":null},{"author":"banana_giraffe","children":[{"author":"jumelles","children":[],"created_at":"2021-08-27T20:48:44.000Z","created_at_i":1630097324,"id":28332812,"options":[],"parent_id":28331922,"points":null,"story_id":28324626,"text":"Seconded, OTP Auth is really nice. It also syncs via iCloud and you can export your info easily.","title":null,"type":"comment","url":null},{"author":"0x0","children":[],"created_at":"2021-08-27T22:20:33.000Z","created_at_i":1630102833,"id":28333582,"options":[],"parent_id":28331922,"points":null,"story_id":28324626,"text":"Yep, the Apple Watch app is a killer app!","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T19:21:47.000Z","created_at_i":1630092107,"id":28331922,"options":[],"parent_id":28331847,"points":null,"story_id":28324626,"text":"On the topic of TOTP apps, I like "OTP Auth" for iOS devices. It's fairly simple, and offers an Apple Watch client that works well.","title":null,"type":"comment","url":null},{"author":"jcims","children":[{"author":"codetrotter","children":[],"created_at":"2021-08-27T19:35:02.000Z","created_at_i":1630092902,"id":28332087,"options":[],"parent_id":28331980,"points":null,"story_id":28324626,"text":"> roll your own
Libraries for a couple of other languages:
https://crates.io/search?q=4226
https://pkg.go.dev/search?q=4226","title":null,"type":"comment","url":null},{"author":"tyingq","children":[{"author":"jjnoakes","children":[{"author":"tyingq","children":[{"author":"pennaMan","children":[],"created_at":"2021-08-28T06:05:43.000Z","created_at_i":1630130743,"id":28335993,"options":[],"parent_id":28334614,"points":null,"story_id":28324626,"text":"You forgot to add the test cases :)","title":null,"type":"comment","url":null}],"created_at":"2021-08-28T01:03:12.000Z","created_at_i":1630112592,"id":28334614,"options":[],"parent_id":28334447,"points":null,"story_id":28324626,"text":"Meaning the core TOTP piece isn't much code, and a library might not store/encrypt the seed, display the data, etc, in a way that you want. The bulk of the code for an authenticator app isn't typically the TOTP bit.","title":null,"type":"comment","url":null}],"created_at":"2021-08-28T00:25:45.000Z","created_at_i":1630110345,"id":28334447,"options":[],"parent_id":28333285,"points":null,"story_id":28324626,"text":"True, I also type this in from memory whenever I need a quick TOTP calculation.","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T21:44:25.000Z","created_at_i":1630100665,"id":28333285,"options":[],"parent_id":28331980,"points":null,"story_id":28324626,"text":"It's almost overkill to bother with a library.
#!/usr/bin/env python3\n import time, hmac, base64, struct\n def totp(seed,curtime,period,len):\n k = base64.b32decode(seed)\n mac = hmac.new(k, struct.pack('>Q', int(curtime/period)), 'sha1').digest()\n offset=mac[-1] & 0x0f\n otp=struct.unpack('>L', mac[offset:offset+4])[0] & 0x7fffffff\n return str(otp)[-len:].zfill(len)\n\n myseed='KRUGS4ZANFZSAYJAOJQW4ZDPNUQHG5DS' # use gpg or similar to store\n print(totp(myseed,time.time(),60,6))https://authy.com/account/delete/","title":null,"type":"comment","url":null},{"author":"thaumasiotes","children":[{"author":"SturgeonsLaw","children":[{"author":"thaumasiotes","children":[{"author":"SturgeonsLaw","children":[],"created_at":"2021-08-29T00:08:41.000Z","created_at_i":1630195721,"id":28342733,"options":[],"parent_id":28337134,"points":null,"story_id":28324626,"text":"That depends on whether the backups are automatic and ongoing, or if they're the "scan this QR code to transfer to a new device" type. The former will be fine if the original device is lost, the latter will not be.","title":null,"type":"comment","url":null}],"created_at":"2021-08-28T10:59:31.000Z","created_at_i":1630148371,"id":28337134,"options":[],"parent_id":28335360,"points":null,"story_id":28324626,"text":"> authenticator apps that let you transfer the codes by initiating a backup or generating a QR code, but that won't work if the previous device is at the bottom of a lake.
You've got a strange definition of "backup" if you think it won't work after the subject of the backup has been destroyed. What would be the point of a backup that stopped working whenever you needed it?","title":null,"type":"comment","url":null}],"created_at":"2021-08-28T03:21:18.000Z","created_at_i":1630120878,"id":28335360,"options":[],"parent_id":28333241,"points":null,"story_id":28324626,"text":"It means getting access to your 2FA codes on a new device is as straightforward as installing the app and signing in. Other commenters have mentioned authenticator apps that let you transfer the codes by initiating a backup or generating a QR code, but that won't work if the previous device is at the bottom of a lake.","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T21:38:16.000Z","created_at_i":1630100296,"id":28333241,"options":[],"parent_id":28332548,"points":null,"story_id":28324626,"text":"What's the concept behind having an Authy account? It converts a TOTP seed into a time-based TOTP code. No part of that suggests that you'd need an account.","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T20:18:12.000Z","created_at_i":1630095492,"id":28332548,"options":[],"parent_id":28331847,"points":null,"story_id":28324626,"text":"Hard no from me.
I remember when Authy refused to delete my account, prior to their acquisition, despite promising to do so upon request in their terms of service. I wasn't the only one: https://news.ycombinator.com/item?id=9100525
There are plenty of free and open source TOTP authenticators (that don't require you to provide your phone number), and I don't see a good reason to use Authy over them.","title":null,"type":"comment","url":null},{"author":"sebazzz","children":[{"author":"philjohn","children":[],"created_at":"2021-08-28T07:13:05.000Z","created_at_i":1630134785,"id":28336228,"options":[],"parent_id":28332663,"points":null,"story_id":28324626,"text":"+1 to this. Yes, it's a bit of a pain to setup with multiple keys, but your secret is stored within the Yubikey itself which is far more secure.","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T20:31:10.000Z","created_at_i":1630096270,"id":28332663,"options":[],"parent_id":28331847,"points":null,"story_id":28324626,"text":"For those with a Yubikey, those people can use Yubikey Authenticator on both mobile and desktop.","title":null,"type":"comment","url":null},{"author":"tzs","children":[{"author":"thaumasiotes","children":[{"author":"tzs","children":[],"created_at":"2021-08-28T14:11:26.000Z","created_at_i":1630159886,"id":28338217,"options":[],"parent_id":28333189,"points":null,"story_id":28324626,"text":"I've tried a variety of pronunciations. Trying for "au" as in "caught" got me "healthy" and once it opened PCalc(?!).
Pronouncing "au" like the "ou" in "ouch" seems to be about the best, but then it tends to mess up the other end, thinking I want "authi". Sometimes it even think "alfie". Somehow it even occasionally hears "elsewise" or "offline". I have no idea how it gets those.","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T21:31:18.000Z","created_at_i":1630099878,"id":28333189,"options":[],"parent_id":28332701,"points":null,"story_id":28324626,"text":"Do you pronounce "authy" and "oathy" the same way? I'd expect "authy" to use whatever vowel you use for "caught", not the vowel of "au revoir".","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T20:35:24.000Z","created_at_i":1630096524,"id":28332701,"options":[],"parent_id":28331847,"points":null,"story_id":28324626,"text":"Authy also works on Apple Watch. I've found it very difficult to get Siri to understand "open Authy". It usually ends up saying there is no app name "oathy".
Spelling it out usually works: "open A U T H Y".","title":null,"type":"comment","url":null},{"author":"conductor","children":[{"author":"sureglymop","children":[],"created_at":"2021-08-27T21:10:30.000Z","created_at_i":1630098630,"id":28333010,"options":[],"parent_id":28332767,"points":null,"story_id":28324626,"text":"Wow really? I never knew that, I've been using andOTP.","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T20:43:23.000Z","created_at_i":1630097003,"id":28332767,"options":[],"parent_id":28331847,"points":null,"story_id":28324626,"text":"Also, KeePassXC[0] (a password manager) has integrated TOTP, which is very handy.
[0] https://keepassxc.org/","title":null,"type":"comment","url":null},{"author":"remuskaos","children":[{"author":"saganus","children":[{"author":"nichos","children":[],"created_at":"2021-08-28T02:23:55.000Z","created_at_i":1630117435,"id":28335054,"options":[],"parent_id":28333641,"points":null,"story_id":28324626,"text":"interesting, i migrated from authenticator, but did it 1 at a time. Check out andOTP, another great open source alternative, maybe it has these features.","title":null,"type":"comment","url":null},{"author":"lolinder","children":[],"created_at":"2021-08-28T04:08:36.000Z","created_at_i":1630123716,"id":28335569,"options":[],"parent_id":28333641,"points":null,"story_id":28324626,"text":"https://github.com/beemdevelopment/Aegis/issues/701
Aegis does support importing from Google authenticator, it just doesn't make that very clear. You do it the same way you add any other code. The hard part for me was getting the QR code into scannable form. This issue explains one way, but you can also just take a picture of the phone with another device.","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T22:29:56.000Z","created_at_i":1630103396,"id":28333641,"options":[],"parent_id":28333420,"points":null,"story_id":28324626,"text":"I was interested in using Aegis, but unfortunately I can't import my current keys from Google Authenticator.
It's "supported" but only via accesing the Authenticator's files (or by havitng root access) which in my celphone is not possible (OnePlus Nord).
Weirdly enough, Aegis does not support bulk importing keys from a QR code, which is how you can migrate from one Authenticator instance to another (e.g. to a new phone).
And I am too lazy to go over each key, reset it and load it up again in Aegis.
Hooefully they'll add this feature at some point in the future.","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T22:00:16.000Z","created_at_i":1630101616,"id":28333420,"options":[],"parent_id":28331847,"points":null,"story_id":28324626,"text":"There is also Aegis[1]. It's FOSS and available in F Droid and Play Store. Authy is pretty good, but doesn't support export of the secrets used for TOTP, whereas Aegis supports export to json and GPG encrypted json.
I've been using Authy for a few years, but switched to Aegis about three years ago and couldn't be happier. Since Authy doesn't support direct export of the secrets, I've had to use a workaround [2].
[1] https://getaegis.app/\n[2] https://gist.github.com/JacobJohansen/5f688d45049be440b8ee87...","title":null,"type":"comment","url":null},{"author":"_Anima_","children":[],"created_at":"2021-08-27T23:27:53.000Z","created_at_i":1630106873,"id":28334115,"options":[],"parent_id":28331847,"points":null,"story_id":28324626,"text":"I deleted my Authy account after the acquisition. The deletion process was a bit of a struggle for reasons I don't recall clearly.
I now use Aegis on phone and the otp plugin of pass on my Linux desktops (+ a ulauncher plugin).","title":null,"type":"comment","url":null},{"author":"toastal","children":[],"created_at":"2021-08-28T02:36:19.000Z","created_at_i":1630118179,"id":28335121,"options":[],"parent_id":28331847,"points":null,"story_id":28324626,"text":"There's also an TOTP pass extension.
https://github.com/tadfisher/pass-otp
Like others have mentioned, it unlike Authy this doesn't use your phone number as identity","title":null,"type":"comment","url":null},{"author":"timwis","children":[],"created_at":"2021-08-28T08:33:15.000Z","created_at_i":1630139595,"id":28336536,"options":[],"parent_id":28331847,"points":null,"story_id":28324626,"text":"Note that authy\u2019s login (twilio login) uses sms-based 2fa itself, which is very vulnerable to sim-swap attacks. There is no way to disable sms 2fa on it.
To counter this I recommend disabling device sync in Authy, and only enabling it temporarily when you add a new device.","title":null,"type":"comment","url":null},{"author":"fetzu","children":[],"created_at":"2021-08-28T09:05:04.000Z","created_at_i":1630141504,"id":28336671,"options":[],"parent_id":28331847,"points":null,"story_id":28324626,"text":"For iOS users, I can really recommend Raivo OTP[0] a FOSS app that offers everything Authy does (backups included) with easy ways to migrate in- and out- of the app through an encrypted ZIP export of all your TOTP keys.
[0] https://github.com/raivo-otp/ios-application","title":null,"type":"comment","url":null},{"author":"AnonC","children":[],"created_at":"2021-08-28T13:36:18.000Z","created_at_i":1630157778,"id":28337924,"options":[],"parent_id":28331847,"points":null,"story_id":28324626,"text":"The mandatory requirement of a phone number to even set this up (with SMS as the verification method) doesn\u2019t suit me. I use other TOTP apps that don\u2019t ask for a phone number or email address or anything else.","title":null,"type":"comment","url":null},{"author":"jamra","children":[],"created_at":"2021-08-28T15:25:16.000Z","created_at_i":1630164316,"id":28338771,"options":[],"parent_id":28331847,"points":null,"story_id":28324626,"text":"Authy once deleted local credentials during an app update. I had to restore with my backup keys.. only I lost my backup keys so I had to go the long way to circumvent my 2fa. They didn\u2019t seem very sorry about it either.","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T19:13:08.000Z","created_at_i":1630091588,"id":28331847,"options":[],"parent_id":28324626,"points":null,"story_id":28324626,"text":"One really good TOTP app for desktops is Authy [0] from Twilio. Some people are not aware that it exists and you don't need an app on your phone for TOTP. Authy works from your desktop as well.
[0] https://authy.com/download/ (scroll down to see Desktop version for download)","title":null,"type":"comment","url":null},{"author":"jrm4","children":[{"author":"thaumasiotes","children":[{"author":"jrm4","children":[{"author":"jrm4","children":[],"created_at":"2021-08-28T14:46:49.000Z","created_at_i":1630162009,"id":28338492,"options":[],"parent_id":28338422,"points":null,"story_id":28324626,"text":"Oh heck, found the answer, apparently so? Cool.\nhttps://github.com/puddly/android-otp-extractor","title":null,"type":"comment","url":null}],"created_at":"2021-08-28T14:37:34.000Z","created_at_i":1630161454,"id":28338422,"options":[],"parent_id":28333217,"points":null,"story_id":28324626,"text":"I'm trying to parse your second sentence, and I think I somewhat agree in a technical sense, but I think it would be fairer to say, Duo forces a second factor on you, whereas Google gives you the option; and in the long run it's better to not babysit people through a "lie."
Last sentence? Serious question. Can you? I was just presuming that you can't; i.e. if I were to build a freedom-reducing proprietary solution like this, I'd keep the the key on my home servers and only deliver the 6 digit codes?","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T21:35:13.000Z","created_at_i":1630100113,"id":28333217,"options":[],"parent_id":28332412,"points":null,"story_id":28324626,"text":"> One pernicious "lie through technology" that is out there is that TOTP et al are something special that must be done through some sort of secret or proprietary app or worse, hardware key device.
It's a lie, but you only have a second factor if it's true. Your Duo is attempting to deliver what it promises, where Google Authenticator doesn't even make the attempt.
You can extract the secret directly from the app, though, if you have the option to use it as an app.","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T20:04:06.000Z","created_at_i":1630094646,"id":28332412,"options":[],"parent_id":28324626,"points":null,"story_id":28324626,"text":"Good stuff. One pernicious "lie through technology" that is out there is that TOTP et al are something special that must be done through some sort of secret or proprietary app or worse, hardware key device.
Nothing wrong with having these as an option -- but e.g. recently my workplace mandated using Duo (the 2FA thing, not google) for our 2FA stuff -- which doesn't let you keep your own generating keys. It's literally the only 2FA thing I have that won't let you do this, and its infuriating because I use oathtool for all the others.
And this is at a university -- so effectively this means you must have a modern cell phone with a particular app or buy a dongle or you can't do school.","title":null,"type":"comment","url":null},{"author":"zaphirplane","children":[],"created_at":"2021-08-27T21:51:14.000Z","created_at_i":1630101074,"id":28333353,"options":[],"parent_id":28324626,"points":null,"story_id":28324626,"text":"I wonder why credit card issuers haven\u2019t gotten on that idea. Whenever I use my credit card I have to enter a onetime /time based amount based pin.
Rather than the system of anyone that knows my card number can charge whatever amount they like for however long they want","title":null,"type":"comment","url":null},{"author":"karmicthreat","children":[],"created_at":"2021-08-27T22:28:00.000Z","created_at_i":1630103280,"id":28333625,"options":[],"parent_id":28324626,"points":null,"story_id":28324626,"text":"I like using Yubico Authenticator. I have a primary and backup Yubikey and I copy the TOTP secret to both. Its also nice that the secret is kept on the key rather than my phone.","title":null,"type":"comment","url":null},{"author":"Unklejoe","children":[],"created_at":"2021-08-27T22:29:44.000Z","created_at_i":1630103384,"id":28333639,"options":[],"parent_id":28324626,"points":null,"story_id":28324626,"text":"Does Google itself support TOTP with Google Authenticator? When I try to enable 2FA, the only options seem to be a text, call, security key (I\u2019m guessing this is FIDO?), and \u201cget a notification on your device\u201d.","title":null,"type":"comment","url":null},{"author":"knorker","children":[],"created_at":"2021-08-27T23:08:06.000Z","created_at_i":1630105686,"id":28333969,"options":[],"parent_id":28324626,"points":null,"story_id":28324626,"text":"How does this article not link to the specs, aka the RFCs?","title":null,"type":"comment","url":null},{"author":"nick_name","children":[{"author":"dxdm","children":[{"author":"muldvarp","children":[],"created_at":"2021-08-28T09:45:49.000Z","created_at_i":1630143949,"id":28336828,"options":[],"parent_id":28334953,"points":null,"story_id":28324626,"text":"Although "heavy lifting" is a bit of an overstatement here. pyotp has around 200 lines of code.","title":null,"type":"comment","url":null}],"created_at":"2021-08-28T02:02:51.000Z","created_at_i":1630116171,"id":28334953,"options":[],"parent_id":28334605,"points":null,"story_id":28324626,"text":"I think you forgot to install that 3rd party dependency that does all the heavy lifting here.","title":null,"type":"comment","url":null}],"created_at":"2021-08-28T01:01:56.000Z","created_at_i":1630112516,"id":28334605,"options":[],"parent_id":28324626,"points":null,"story_id":28324626,"text":"
# python3 -m pip install pyotp\n SECRET='JBSWY3DPEHPK3PXP' python3 -c "import pyotp; print(pyotp.TOTP('${SECRET}').now())"https://github.com/edify42/otp-codegen","title":null,"type":"comment","url":null},{"author":"bondolo","children":[],"created_at":"2021-08-28T02:26:17.000Z","created_at_i":1630117577,"id":28335065,"options":[],"parent_id":28324626,"points":null,"story_id":28324626,"text":"Does the password strategy really just truncate passwords over 64 characters? I don't use them often but since text passwords typically have low number of significant bits per character I have always assumed that the input string was hashed to a fixed length password that would increase in quality until the randomness of the text approached random bytes. My current secure passphrase is a paragraph that I have memorized from a book, about 250 characters, but I only type it a couple of times per month. Disappointing if 190 or so characters of this typing is indeed wasted effort and that at least 8 bytes or more (1-3 bits per character) of entropy is wasted per password because text doesn't use all 8 bits.","title":null,"type":"comment","url":null},{"author":"mullingitover","children":[{"author":"tim333","children":[],"created_at":"2021-08-28T08:26:48.000Z","created_at_i":1630139208,"id":28336519,"options":[],"parent_id":28335162,"points":null,"story_id":28324626,"text":"A non techy friend of mine had some bad issues in that she had it on an iPhone, switched to a new iPhone copying everything over via icloud as one usually does and then finding Google Auth didn't copy the auth codes over or warn you that it won't, and hence was locked out of various accounts.","title":null,"type":"comment","url":null}],"created_at":"2021-08-28T02:42:54.000Z","created_at_i":1630118574,"id":28335162,"options":[],"parent_id":28324626,"points":null,"story_id":28324626,"text":"> How does Google Authenticator work?
Really poorly. Not only my experience, also the prevailing sentiment in app store reviews, where it has a sub-2.5 star rating.
Up until pretty recently you couldn't even back up your passcodes, so it was extremely risky to use it.
Use Authy, there is clearly a lot more effort put into that app.","title":null,"type":"comment","url":null},{"author":"js2","children":[],"created_at":"2021-08-28T04:35:00.000Z","created_at_i":1630125300,"id":28335649,"options":[],"parent_id":28324626,"points":null,"story_id":28324626,"text":"There\u2019s also a tool that converts Symantec VIP Access tokens to standard TOTP tokens:
https://github.com/dlenski/python-vipaccess","title":null,"type":"comment","url":null},{"author":"janfromdaito","children":[],"created_at":"2021-08-28T15:00:36.000Z","created_at_i":1630162836,"id":28338585,"options":[],"parent_id":28324626,"points":null,"story_id":28324626,"text":"Not a big fan of a Google Authentcator myself, and didnt want to stay with Authy as well, thus I started working on my own authenticator, which is web-ased: https://www.daito.io/
The main differentiator is that this a web-based authenticator, not an app-based one. The main goal being a fully separate service (thus full separation of concerns) from a password manager. It's not ready for prime time yet, but if you are interested to test it, please reach out.","title":null,"type":"comment","url":null},{"author":"lazyant","children":[],"created_at":"2021-08-28T16:38:13.000Z","created_at_i":1630168693,"id":28339370,"options":[],"parent_id":28324626,"points":null,"story_id":28324626,"text":"https://www.trustedreviews.com/news/google-ignored-a-key-vul...","title":null,"type":"comment","url":null}],"created_at":"2021-08-27T05:38:14.000Z","created_at_i":1630042694,"id":28324626,"options":[],"parent_id":null,"points":252,"story_id":28324626,"text":null,"title":"How does Google Authenticator work?","type":"story","url":"https://prezu.ca/post/2021-07-30-totp-1/"}