3 ms·

What is the mechanism for a "second device" backup option, how does that work an what TOTP products support it how?

tzs 5y ago
The simplest case, applicable if you have access to more than one device that supports generating TOTP codes at the time you are setting up TOTP for a given site, is to simply scan the site's QR code on all the devices. E.g., when I create an account at a site that uses TOTP I scan the QR code on both my phone and my tablet. (Actually, I scan it twice on each device, using two different TOTP apps. That way I'm covered if one of the apps stops being supported). If you don't have all your devices available at the same time, or you want to allow for the possibility of adding a new device later, you can simply save the QR code. When the site gives you the QR code, take a screenshot and save that in some secure fashion. I save it as an encrypted PNG file. To add a TOTP device later view the screenshot and scan the QR code. Most sites that give you a TOTP QR code have an option to get the code in text. As an alternative to (or in addition to) saving a screenshot of the QR code you can ask for the text code and save that. Securing a text file might be more convenient for some people than securing an image file, although using the text code to set up a new phone or tablet likely won't be as convenient as using a QR code.
- jrochkind1 5y ago
  Interesting, thanks! I guess you need to keep these QR codes/texts as carefully/securely as you would any password.... This is all a lot of work, trying to figure out how to adjust to this world of 2FA.
  - tzs 5y ago
    The good news is that the QR codes and/or texts should be easier to secure than passwords. You need the password every time you login to a site, so you need to find a way to securely store passwords that also allows easy frequent access to the password. You only need the QR code when setting up a TOTP application on one of your devices which generally will only be once per device and then once whenever you replace a device. You don't need frequent easy access and so can pick a storage method that is optimized toward ease of initial storage. For example if I've just signed up for site example.com and I've saved a screenshot of the QR code in example.png, I'd do this: $ gpg -ear tzs@mydomain example.png $ mv example.png.asc ~/OneDrive/totp-recovery $ rm example.png and then I no longer have to think about it or do anything with it unless I need to set up a new device, which is very rare.
UncleMeat 5y ago
On my banking website I enroll my phone’a TOTP app and my wife’s TOTP app. If I drop my phone in the toilet I can authenticate with her phone.

tzs 5y ago

The simplest case, applicable if you have access to more than one device that supports generating TOTP codes at the time you are setting up TOTP for a given site, is to simply scan the site's QR code on all the devices. E.g., when I create an account at a site that uses TOTP I scan the QR code on both my phone and my tablet. (Actually, I scan it twice on each device, using two different TOTP apps. That way I'm covered if one of the apps stops being supported). If you don't have all your devices available at the same time, or you want to allow for the possibility of adding a new device later, you can simply save the QR code. When the site gives you the QR code, take a screenshot and save that in some secure fashion. I save it as an encrypted PNG file. To add a TOTP device later view the screenshot and scan the QR code. Most sites that give you a TOTP QR code have an option to get the code in text. As an alternative to (or in addition to) saving a screenshot of the QR code you can ask for the text code and save that. Securing a text file might be more convenient for some people than securing an image file, although using the text code to set up a new phone or tablet likely won't be as convenient as using a QR code.

jrochkind1 5y ago
Interesting, thanks! I guess you need to keep these QR codes/texts as carefully/securely as you would any password.... This is all a lot of work, trying to figure out how to adjust to this world of 2FA.
- tzs 5y ago
  The good news is that the QR codes and/or texts should be easier to secure than passwords. You need the password every time you login to a site, so you need to find a way to securely store passwords that also allows easy frequent access to the password. You only need the QR code when setting up a TOTP application on one of your devices which generally will only be once per device and then once whenever you replace a device. You don't need frequent easy access and so can pick a storage method that is optimized toward ease of initial storage. For example if I've just signed up for site example.com and I've saved a screenshot of the QR code in example.png, I'd do this: $ gpg -ear tzs@mydomain example.png $ mv example.png.asc ~/OneDrive/totp-recovery $ rm example.png and then I no longer have to think about it or do anything with it unless I need to set up a new device, which is very rare.

UncleMeat 5y ago

On my banking website I enroll my phone’a TOTP app and my wife’s TOTP app. If I drop my phone in the toilet I can authenticate with her phone.