2 ms·
Good stuff. One pernicious "lie through technology" that is out there is that TOTP et al are something special that must be done through some sort of secret or
by jrm4 5y ago
Good stuff. One pernicious "lie through technology" that is out there is that TOTP et al are something special that must be done through some sort of secret or proprietary app or worse, hardware key device.
Nothing wrong with having these as an option -- but e.g. recently my workplace mandated using Duo (the 2FA thing, not google) for our 2FA stuff -- which doesn't let you keep your own generating keys. It's literally the only 2FA thing I have that won't let you do this, and its infuriating because I use oathtool for all the others.
And this is at a university -- so effectively this means you must have a modern cell phone with a particular app or buy a dongle or you can't do school.
- thaumasiotes 5y ago> One pernicious "lie through technology" that is out there is that TOTP et al are something special that must be done through some sort of secret or proprietary app or worse, hardware key device. It's a lie, but you only have a second factor if it's true. Your Duo is attempting to deliver what it promises, where Google Authenticator doesn't even make the attempt. You can extract the secret directly from the app, though, if you have the option to use it as an app.
- jrm4 5y agoI'm trying to parse your second sentence, and I think I somewhat agree in a technical sense, but I think it would be fairer to say, Duo forces a second factor on you, whereas Google gives you the option; and in the long run it's better to not babysit people through a "lie." Last sentence? Serious question. Can you? I was just presuming that you can't; i.e. if I were to build a freedom-reducing proprietary solution like this, I'd keep the the key on my home servers and only deliver the 6 digit codes?
- jrm4 5y agoOh heck, found the answer, apparently so? Cool. https://github.com/puddly/android-otp-extractor https://github.com/puddly/android-otp-extractor