5 ms·

I know it's not easy for grandmas/etc, but I personally love classic TOTP solution. It's stupidly simple to backup[1], works on all my devices - even my desktop

I know it's not easy for grandmas/etc, but I personally love classic TOTP solution. It's stupidly simple to backup[1], works on all my devices - even my desktop if I want, and is completely secure[2]. It's a shame so many people have no clue you can (and should, imo!) backup your TOTP key. [1]: just copy the string and store it however you want. [2]: as far as I'm aware. I'm not a security professional, of course.

faitswulff 9y ago
For anyone else who was wondering: "The Time-based One-Time Password algorithm (TOTP) is an algorithm that computes a one-time password from a shared secret key and the current time." https://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm https://en.wikipedia.org/wiki/Time-based_One-time_Password_A...
- notheguyouthink 9y ago
  Yea sorry, I should have included a explanation - I used it instead of Google Auth to remove any implied involvement with Google. Appreciate your annotation!
saganus 9y ago
Whenever a 2FA or TOTP article comes out, I ask if anyone knows of a hardware dongle/token/card that can store several TOTP keys so that I can stop using my phone for 2FA (e.g. Google Authenticator). I've only found the Protectimus Slim NFC [0], which would be my ideal solution except it only holds 1 key. If it could save say, 100 keys (or even 50 maybe?), I would buy 3 or 4 in a heartbeat. It would be great to have stronger 2FA than SMS, but with the peace of mind of not having to worry about the phone. I'm definitely not a hardware guy, but I can't believe such a solution doesn't exist yet. It doesn't seem like it would be hard to build, right? I mean, you just need a very simple processor, a real-time clock, a display and an NFC module for reprogramming (or maybe micro-usb?). Does anyone know of any products like the Protectimus but supporting multiple keys? [0] https://www.protectimus.com/protectimus-slim-mini https://www.protectimus.com/protectimus-slim-mini
- raulpopa 9y ago
  I know it's not a hardware solution but check out this Chrome extension: https://chrome.google.com/webstore/detail/typingdna-authenticator/gmohoglkppnemohbcgjakmgengkeaphi https://chrome.google.com/webstore/detail/typingdna-authenti... It protects your keys with your typing pattern.
- davchana 9y ago
  You can manually save TOTP key in a keepass db on any usb, and even anywhere else too.
  - saganus 9y ago
    Yeah, I actually already do that, but it's not the same as having a Google Authenticator in hardware in terms of convenience.
- vel0city 9y ago
  The NFC versions of YubiKeys (only the NEO I believe) support TOTP with their app. The model I have supports 28 slots.
  - saganus 9y ago
    I actually own one of those YubiKeys but the issue with needing an app is the portability (or lack of). Ideally I'd love to have a hardware token that I can use for TOTP authentication regardless of the computer I'm working with.
Spivak 9y ago
You're ignoring that the main TOTP app for most people, Google Authenticator, doesn't allow the keys to be exported. The current solution if you buy a new phone is to manually remove and re-add 2FA on every site you use it with.
- notheguyouthink 9y ago
  > You're ignoring that the main TOTP app for most people, Google Authenticator, doesn't allow the keys to be exported. The current solution if you buy a new phone is to manually remove and re-add 2FA on every site you use it with. I'm not ignoring that at all. Google Authenticator is the only one I use, even with the described workflow. I back the key up immediately, when they're asking you to save the TOTP. They usually (not always!) give you multiple methods to input the TOTP, such as scanning an image or typing in a string. That string can be backed up, and is what I usually use. I never renew my TOTP, and all I use is Google Authenticator. Anytime I get a new phone (nearly every year, heh), I just add my TOTPs back. This of course doesn't work for non-tech people, it's a bit too manual. I acknowledged that in my first post, though.
jpindar 9y ago
What makes it difficult for grandmas as opposed to any other demographic group?

faitswulff 9y ago

For anyone else who was wondering: "The Time-based One-Time Password algorithm (TOTP) is an algorithm that computes a one-time password from a shared secret key and the current time." https://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm https://en.wikipedia.org/wiki/Time-based_One-time_Password_A...

notheguyouthink 9y ago
Yea sorry, I should have included a explanation - I used it instead of Google Auth to remove any implied involvement with Google. Appreciate your annotation!

saganus 9y ago

Whenever a 2FA or TOTP article comes out, I ask if anyone knows of a hardware dongle/token/card that can store several TOTP keys so that I can stop using my phone for 2FA (e.g. Google Authenticator). I've only found the Protectimus Slim NFC [0], which would be my ideal solution except it only holds 1 key. If it could save say, 100 keys (or even 50 maybe?), I would buy 3 or 4 in a heartbeat. It would be great to have stronger 2FA than SMS, but with the peace of mind of not having to worry about the phone. I'm definitely not a hardware guy, but I can't believe such a solution doesn't exist yet. It doesn't seem like it would be hard to build, right? I mean, you just need a very simple processor, a real-time clock, a display and an NFC module for reprogramming (or maybe micro-usb?). Does anyone know of any products like the Protectimus but supporting multiple keys? [0] https://www.protectimus.com/protectimus-slim-mini https://www.protectimus.com/protectimus-slim-mini

raulpopa 9y ago
I know it's not a hardware solution but check out this Chrome extension: https://chrome.google.com/webstore/detail/typingdna-authenticator/gmohoglkppnemohbcgjakmgengkeaphi https://chrome.google.com/webstore/detail/typingdna-authenti... It protects your keys with your typing pattern.
davchana 9y ago
You can manually save TOTP key in a keepass db on any usb, and even anywhere else too.
- saganus 9y ago
  Yeah, I actually already do that, but it's not the same as having a Google Authenticator in hardware in terms of convenience.
vel0city 9y ago
The NFC versions of YubiKeys (only the NEO I believe) support TOTP with their app. The model I have supports 28 slots.
- saganus 9y ago
  I actually own one of those YubiKeys but the issue with needing an app is the portability (or lack of). Ideally I'd love to have a hardware token that I can use for TOTP authentication regardless of the computer I'm working with.

Spivak 9y ago

You're ignoring that the main TOTP app for most people, Google Authenticator, doesn't allow the keys to be exported. The current solution if you buy a new phone is to manually remove and re-add 2FA on every site you use it with.

notheguyouthink 9y ago
> You're ignoring that the main TOTP app for most people, Google Authenticator, doesn't allow the keys to be exported. The current solution if you buy a new phone is to manually remove and re-add 2FA on every site you use it with. I'm not ignoring that at all. Google Authenticator is the only one I use, even with the described workflow. I back the key up immediately, when they're asking you to save the TOTP. They usually (not always!) give you multiple methods to input the TOTP, such as scanning an image or typing in a string. That string can be backed up, and is what I usually use. I never renew my TOTP, and all I use is Google Authenticator. Anytime I get a new phone (nearly every year, heh), I just add my TOTPs back. This of course doesn't work for non-tech people, it's a bit too manual. I acknowledged that in my first post, though.

jpindar 9y ago

What makes it difficult for grandmas as opposed to any other demographic group?