10 ms·
TOTP tokens on my wrist with the smartest dumb watch
- sneak 4y agoCool hack. That said: A security reminder to anyone who is in the target audience here: if you're clever enough to have TOTP 2FA enabled on your Google account, get some cheap USB security keys and enable Advanced Protection, which completely disables non-hardware 2FA. It requires two different tokens (and you should really get one for each computer you have/use, plus at least one offsite backup) because once enabled it actually and completely locks anyone out of the account that does not possess one of the enrolled tokens. https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/ TOTP is not much better than SMS-based 2FA. It's still vulnerable to phishing, local device malware (that attacks your TOTP in your password manager), etc. It's best to use hardware tokens everywhere that support them, and both Google and GitHub do. (And Google supports a special hardware token only mode which I wish more sites would adopt.)
- amelius 4y ago> which completely disables non-hardware 2FA Does this make Google stop asking for my phone number?
- deleted 4y ago[deleted]
- xupybd 4y agoCan you recommend any cheap USB security keys? I've looked in the past and cost has been prohibitive.
- madc 4y agoHave you looked into these? https://solokeys.com https://solokeys.com
- rjzzleep 4y agoI was a backer of the V2 and I think my order is now a year overdue. I don't really back things on kickstarter because I don't like to gamble, but this seemed like a sure bet. Turns out it wasn't.
- ibotty 4y agoI got my solokeys v2. A bummer that they did not ship to some folks.
- Brajeshwar 4y agoNot them but I have stopped backing projects on Kickstarter, because I have been burned to the tune of $2,000+ (2016-17-ish currency conversion).
- stavros 4y agoI got mine (and it randomly died so they sent me a second one). You still haven't received your first one? That sucks, they're generally very good devices (minus them randomly dying, I guess).
- sneak 4y agoI have a $50 yubikey nano plugged into each of my multiple-thousand-dollar computers, protecting my accounts containing/accessing client data worth millions. If anything under $100 is too much to secure your account, just use SMS 2FA, or disable 2FA entirely.
- masklinn 4y agoFwiw big players regularly give free keys to e.g. OSS maintainers. Dunno if it’s still active but Pypy has a program for maintainers of crates flagged as sensitive (or something like that), you can get two Titan keys courtesy of google. I also have a pair of github-branded yubikeys from a long time ago but I don’t remember what that program was. > cost has been prohibitive. A titan is 35 or so, hardly prohibitive. And if you have access to anything important your company ought be glad to get you one or two, or yubis.
- niel 4y agoCloudflare and Yubico are in partnership to provide YubiKeys at a discount: https://www.cloudflare.com/products/zero-trust/phishing-resistant-mfa/ https://www.cloudflare.com/products/zero-trust/phishing-resi... Related thread: https://news.ycombinator.com/item?id=33020078 https://news.ycombinator.com/item?id=33020078
- sitic 4y agoUS Google One users on a >=2TB plan should currently also have an offer for a free Titan key at https://one.google.com/benefits https://one.google.com/benefits
- Tijdreiziger 4y ago> Eligible customers must have an active zone or actively use Cloudflare Zero Trust.
- rjzzleep 4y ago> TOTP is not much better than SMS-based 2FA. It's still vulnerable to phishing, local device malware (that attacks your TOTP in your password manager), etc. It's best to use hardware tokens everywhere that support them, and both Google and GitHub do. (And Google supports a special hardware token only mode which I wish more sites would adopt.) Since this device doesn't actually have network connectivity he might have this problem potentially when someone is watching his watch with a camera, or if someone is able to do something in his close proximity, which means it absolutely is better than SMS-based 2FA and the phishing attack vector is different and if a person has access to him in close proximity anyway the cheap USB security doesn't offer anything(well not completely true, but almost) over this particular TOTP use case. Security is kinda cool these days and everyone is a security expert, but just reiterating trained responses without actually thinking about the attack vectors is getting a bit annoying. It's as if it is cool to say the most secure use case people can think of without even considering what and who it is that is actually protected and from whom.
- jgrahamc 4y agoTOTP is really vulnerable to phishing. Hardware keys are the solution.
- rjzzleep 4y agoYeah, sure, but then again a watch on your wrist is harder to take away than a hardware key on your physical keychain that you don't pay attention to. EDIT: yes, lol, thank you for explaining what phishing is jgrahamc. We didn't know. I get that a lot of Americans and some Germans guard their car keys like an internal organ, but for a lot of people in the world a keychain is something you toss in an insecure place most of the time of the day.
- vladvasiliu 4y agoIt may be easier to steal, but it should have some kind of minimal protection. It should lock out after a low number of failed pins, for example. The YubiKeys do this.
- vladvasiliu 4y agoWhile I agree with your points regarding the security of TOTP / SMS, and I do push for hardware keys at work, I think a case could be made for a mixed use for "regular people". Maintaining two hardware keys is an absolute PITA, especially if you go down the route of storing one off-site, hence not having it with you to enroll when you get a new account. What I do, is use the hardware token as the "main" factor and use the TOTP if for some reason I don't have the token (I may sometimes forget it at home when I'm at my parents' house). The point is that, since I usually have my key, if I'm presented with a Google or whatever prompt for a TOTP, I know something's fishy. I don't normally use that, so I'll investigate why that happens and won't just go ahead and type my code in there.
- jasonjayr 4y agoThis needs to be repeated too. And developers need to be reminded that anything they secure with hardware keys absolutely needs to accept multiple hardware keys in order to mitigate loss or destruction of the first key.
- deleted 4y ago[deleted]
- mhkool 4y agoI like the yubico key that even has a pin code so if lost or stolen protects your TOTP codes
- quickthrower2 4y agoNot so sure, for me I am going to forget to have the hardware device. I will probably lose it. I will forget to take it with me and then can't access things mobile. Or will take it out with me and lose it. Have enough stuff to keep track of! I would use hardware for some occasional use logins though. Why is TOTP not much better than SMS? Someone can take over your phone contract to get those SMS messages by sweet talking your telco, but for TOTP they need to get hold of my device or get some malware onto my phone.
- tzs 4y ago> TOTP is not much better than SMS-based 2FA. It's still vulnerable to phishing, local device malware (that attacks your TOTP in your password manager), etc. It's still massively better than SMS-bases 2FA. Those vulnerabilities you list are all things that involve you or your device. You can take care to avoid them. With SMS there are also vulnerabilities that don't involve you or your device, such as someone convincing your carrier to transfer your phone number to them.
- UncleMeat 4y agoSIM swap is real but rare, since it cannot be automated. It is also largely defeated by having a strong and unique password, assuming that your provider doesn’t use SMS as a single factor password reset option. If you’ve got a strong and unique password then your primary concern should be phishing, which is the same for sms and totp.
- account42 4y ago> assuming that your provider doesn’t use SMS as a single factor password reset option. That's a big assumption and one that is far from generally true.
- trustingtrust 4y agoThere needs to be a button based passcode to view TOTP instead of just pressing one button once. That would add a layer of security. A combination of buttons and number of presses should still be somewhat added security.
- Arainach 4y agoWhat's the threat model here? The TOTP code is worthless without the password. You would need to get my password and physically obtain the watch; what threat does a button code protect against? Someone who steals the watch from my house doesn't have the password. Someone who phishes the password doesn't have access to the watch. The government agent who has exerted enough physical force or legal coercion to get me to cough up the password can demand the TOTP code at the same time.
- Cthulhu_ 4y agoThe only added security I can think of on a two factor authentication thing is a fingerprint reader on a physical hardware key, and even that's more of a gimmick than anything. And maybe TOTP codes generated from a password manager, but IMO that already defeats the purpose of two-factor because if your one device with password manager is compromised, they have both password and the second factor. The four number code IS the added security already.
- yellow_lead 4y agoHow accurate does the time have to be for TOTP to work? If the watch drifts a bit, will it no longer work? Compared to your phone which is synced with an NTP server.
- petesergeant 4y agoUp to the authenticating service
- joshxyz 4y agoup to the service. some services allow up to 2 windows.
- himlion 4y agoAWS asks you to sync by inputting subsequent codes if it detects keys from the wrong time window.
- VTimofeenko 4y agoThe key lifetime may be other than the default 30 seconds, and IIRC the validator side may be configured to accept keys from N previous generations.
- account42 4y agoI wish all implementations would at least accept one previous generation. It sucks having to either wait for the next code or try to input before the timeout if it is close.
- lesuorac 4y agoI'm not sure I've ran into an implementation that doesn't. I used to wait for the code to rollover before entering it but honestly if you're not sure if the implementation accepts a previous code or now just use that time to try it and if it fails you still have like 45s to enter the current code.
- KingOfCoders 4y agoWhere does one buy the sensor board? Or is it only DIY? [edit] https://www.crowdsupply.com/oddly-specific-objects/sensor-watch#products https://www.crowdsupply.com/oddly-specific-objects/sensor-wa...
- Brajeshwar 4y agoIf you are not that a hacker but already own a Smartwatch such as the Apple Watch, Authy[1] is a pretty rock solid option. I use Authy for a few key credentials, and I have used my watch for the keys. FYI, Authy was bought and is now owned by Twilio 1. https://authy.com https://authy.com
- ayewo 4y agoI use Duo Mobile [1] with my Apple Watch. Authy gets recommended often here but got turned off of them because they require a phone number to set up the app on iOS. There's no phone number requirement for TOTP implementations so I eventually found Duo Mobile. This was before they got bought by Cisco. 1: https://apps.apple.com/us/app/duo-mobile/id422663827 https://apps.apple.com/us/app/duo-mobile/id422663827
- Brajeshwar 4y agoAh! I used Authy because it was one of the very early OGs of TOTP Apps.
- GekkePrutser 4y agoI use AndOTP on Android. You can export to a PGP-encrypted JSON file so your keys are really your own and not locked into a walled garden like Authy.
- Avamander 4y agoAndOTP is great. Especially if you compare it with all the iOS options. iOS TOTP apps all suck, it's amazingly bad. I installed like ~15 different ones. After the fifth try, I just had to know if it was just my poor initial selection or a general problem. Each and every iOS TOTP app has at least one crucial problem - requiring a subscription, mandatory sync to a proprietary cloud, having no export-import, not having a watch companion, being from an unknown/generic developer, no support for longer TOTP codes (worse, some display it truncated!) or they're simply very buggy. I settled on Step Two because it was like all the others, but not an eyesore...
- mkesper 4y agoPlease do not paste your secrets into any website as proposed here for conversion.
- cyanawesome 4y agoSeriously, the QR is just a URI that any QR reader can decode (preferably one you trust). https://github.com/google/google-authenticator/wiki/Key-Uri-Format https://github.com/google/google-authenticator/wiki/Key-Uri-...
- monocasa 4y agoAnd not just that, but TOTP isn't based on public/private crypto, but instead a shared secret embedded in plaintext in that URI.
- deleted 4y ago[deleted]
- Tepix 4y agoNeat. For those who don't want to tinker with hardware (just software) - is there a nice app providing TOTP for the PineTime smartwatch?
- m4lvin 4y agoNot for PineTime, but the bangle.js has a a 2FA TOTP app: https://banglejs.com/apps/?id=authentiwatch https://banglejs.com/apps/?id=authentiwatch For InfiniTime (the PineTime firmware), here is the issue/discussion about it: https://github.com/InfiniTimeOrg/InfiniTime/issues/310 https://github.com/InfiniTimeOrg/InfiniTime/issues/310
- wryun 4y agoIt is pretty trivial to put this board in a Casio watch; I'm not even sure I'd call it tinkering unless you decided you want to connect the buzzer (requires soldering one bit of metal).
- amelius 4y agoWaiting for keyboard with NFC making this even simpler.
- distcs 4y agoIs there some Unix-ish tool to generate these TOTPs on a laptop? I don't like to keep the 2nd factor on a small mobile device that is easy to lose. So I ask about a laptop tool. By Unix-ish I mean something that is small and does one thing well. Like pipe in a secret to it and it gives me a TOTP? Pipe in multiple secrets and it gives me multiple TOTPs? Then I don't have to remain beholden to a custom encryption format. I can encrypt my secrets with other Unix-ish tools, decrypt it, pipe it to this tool and get my TOTPs. Recommendations?
- guipsp 4y agohttps://github.com/WhyNotHugo/totp-cli https://github.com/WhyNotHugo/totp-cli
- tecleandor 4y agoSeveral options... Not exactly the same, but if you're using Bitwarden (which is compatible with generating TOTP tokens) to manage your passwords, you can use their bitwarden-cli tool to request tokens from the cli: https://bitwarden.com/help/cli/#get https://bitwarden.com/help/cli/#get But if you want the simplest cli thing, you can probably can use this golang ( https://github.com/yitsushi/totp-cli https://github.com/yitsushi/totp-cli ) or this python ( https://github.com/WhyNotHugo/totp-cli https://github.com/WhyNotHugo/totp-cli ) implementations.
- wolczek 4y agohttps://keepassxc.org https://keepassxc.org comes with keepassxc-cli
- grenoire 4y agoI just cooked up something in Python if you have it installed on your system, quite straightforward to use. If there's interest, I can prepare a compiled version. Unlike the other ones posted here, this one just takes secrets as arguments: > python -mtotp DGLTPWEUERUUDCEC SWPKQCKEWRXPCRXE 628502 674329 https://pastebin.com/apNKxMBF https://pastebin.com/apNKxMBF
- susam 4y ago
- deleted 4y ago[deleted]
- wryun 4y agoIf you're a bit weirded out by the website secret pasting, I made a PR which lets the sensor watch load TOTP secrets from an Aegis export (essentially just a bunch of TOTP URIs): https://github.com/joeycastillo/Sensor-Watch/pull/95 https://github.com/joeycastillo/Sensor-Watch/pull/95 This is the reason I bought the board. It makes me happy not having to use my phone for this.
- diego_moita 4y agoFor the best smartwatch ever made I recommend Pebble Authenticator: https://github.com/Neal/pebble-authenticator https://github.com/Neal/pebble-authenticator
- cbm-vic-20 4y agoI just wanted to call out how cool it is to replace the guts of a 1980s-era wristwatch with a ARM Cortex M0+ microcontroller, while reusing the original display and buttons.
- andrepd 4y agoOne of my long-term hacker project goals is to replace the guts of an analog watch with a microcontroller and turn it into a "smartwatch-lite". There's a surprising amount of information and features you can display with three pointers (and a small numeric window): temperature, heartrate and other body sensors, NFC to replace payment or access cards, etc.
- wlesieutre 4y agoNot as customizable as what I'm sure you're planning, but Withings makes watches with that design direction https://www.withings.com/us/en/watches https://www.withings.com/us/en/watches
- andrepd 4y agoYep there are plenty of watches like that (for example Fossil I think), but I'd really like to take a nice vintage watch and build a hackable watch platform myself.
- jkepler 4y agoYeah, I had a Withings semismart watch, one of their cheaper models without a screen. It integrated a pedometer, and had a dial had that would show steps taken, it moved from 0 to 100% of your goal. One had to pair it to the Withings Android app to set not just the goal for number of steps/day, but even for setting the time. I sold it after a few months, realizing how much I missed a second hand and a glow-in-the-dark face. Also, the app had a ton of telemetry going back to Withings. Building your own you would be in full control of the data.
- kamranjon 4y agoThis is very cool, I just recently ordered a light phone 2 (a dumb phone) - and one of the things I am currently trying to solve is how I am going to access my google authentication codes for various work and personal project related accounts. Something like this would be very awesome, but also this post really demystifies how this type of auth works.
- tejado 4y agoMaybe Authorizer is something you will like: https://github.com/tejado/Authorizer https://github.com/tejado/Authorizer
- jcpst 4y agoI have been wearing the F-91 every day for a long time. It’s such a classic piece, and the only digital watch that really appealed to me. I’m quite excited at the idea of taking one my old ones and giving it new functionality.
- samcat116 4y agoThis is super cool but do folks really need their google and GitHub 2FA codes often enough to justify this? Browser sessions are pretty durable it seems. The one thing I could think of is GitHub admin type actions that prompt for a credential to enter “sudo” mode or whatever they call it. However in that case they’ll take your password as well (or a webauthn key in my case)
- edent 4y agoI use systems which require a 2FA code every day, or whenever a destructive action takes place. So this is certainly useful for some people.
- m-p-3 4y agoIt saved me a trip back to my desk a few times when I had to sign in to an account protected by 2FA on another computer and I forgot to bring my phone along.
- teaearlgraycold 4y agoI have everything in 1P. No need for a physical device.
- MartinCron 4y agoI always thought that the benefit of the physical device was that it was decoupled from the main device. If someone steals my laptop, for example, they won't be able to access my MFA secured accounts unless they ALSO steal my phone (and are unable to lock it).
- cyphar 4y agoSure, but if your threat model is that the attacker has enough access to your machine to extract your password manager's database, they can also just copy your session cookies from your existing browser session. Even in the case of password leaks, if someone breaches the password database of a website they can just as easily dump the TOTP table. Personally my view is that (if you're using a password manager with a unique password per-site) 2FA primarily protects you when you have to input your password on an untrusted system that may have a keylogger. In that case it doesn't really matter where you store the TOTP key (presumably you're not going to unlock your password database on that machine). To be fair, in the case of a security bug in the password manager (such as the few previous LastPass bugs in this vein), you are slightly more protected. But I use KeePassXC which has a far more segregated design so I'm not as worried about this as I would be if I was using a password manager entirely integrated into the browser (either built-in or an extension). (Though these days I primarily use U2F/WebAuthn if the site supports it.)
- Piisamirotta 4y agoDamn the font size is way too large on my mobile, unreadable.
- 1970-01-01 4y agoWhat's old is new once again. It's the old RSA SecurID token generator, but now it has water-resistance and an LED! I'll buy one.
- jazzyjackson 4y agoI didn't see anything on the site about where to get one, so here's the link to their crowd supply, 36$ for the board. https://www.crowdsupply.com/oddly-specific-objects/sensor-watch https://www.crowdsupply.com/oddly-specific-objects/sensor-wa...
- yunruse 4y agoThe concept of programming a dumb watch is rather appealing; this project looks like one that's both practical and quite fun to work on. It would be rather neat to have a dumb watch that can take in custom embedded code (say Lua) for people who enjoy hacking but are terrible at hardware. I'd buy one day one!
- tacon 4y agoAre there any similar boards or projects for taking over a large wall-mounted LCD clock? I would love to hack on that display.