5 ms·

My excuse is I hate using TOTP. Stop making me open an app, wait for it to load, read numbers, type it in. If you have a situation where you have to auth multip

My excuse is I hate using TOTP. Stop making me open an app, wait for it to load, read numbers, type it in. If you have a situation where you have to auth multiple times, it's even more annoying. Other modern methods are less annoying and (arguably) more secure.

ok123456 4y ago
You don't need an app to do TOTP. You can do it from a command line if you have the secret.
- dingaling 4y ago
  And you could do it with pencil and paper if you wanted. If you were very quick at maths. The point is that it places a requirement on the user and interrupts their workflow when they just want to Get Stuff Done. And if it stops working then the burden is on the user to make it work again.
  - ok123456 4y ago
    That's true of any authentication mechanism. It works until it doesn't. If you wanted to work this into a traditional terminal workflow "generateToken my.host && ssh my.host" TOPT is the least worst way of doing 2FA. I wish I lived in a world where this sort of thing wasn't necessary, but if you have a service where there are accounts that are worth a lot of money in the real world, you need to have some kind of 2FA.
- throwawaaarrgh 4y ago
  RSA SecurID requires their app for TOTP because they have some secret company seed, or something.
  - ok123456 4y ago
    Probably some sad attempt at keeping their enterprise customers locked in.
unethical_ban 4y ago
We'll stop asking for a password, even! But honestly: If the "remember this session" button is checked as it often is for apps and sites, you should only have to do it every once in a while. Or, if the site is a bit more clever, you may only have to 2FA on sensitive screens, such as "edit personal data" or "make purchase" or "transfer money". The nice thing about "non-push" TOTP is that it does not require any external service. A site could generate its own TOTP keys, show you a QR code and let you use any app (Authy, 2FAone, Google Authenticator, etc) to manage those codes. And your phone can be offline and still work with it, and you can back up your own 2FA keys. "Push" based 2FA requires a service, typically paid, like Okta or RSA.
- throwaway290 4y ago
  > every once in a while Every time you change device or browser, for many services when you change your IP country, and many services limit the amount of remembered device sessions meaning you basically have to do it every day. Multiply by the number of services that force 2FA. Pray your VPN behavior or travel did not get you some hidden red flag.
CopOnTheRun 4y ago
Bitwarden can generate TOTPs that get copied to your clipboard after filling the username and password box for a website. Usually all that's required is an extra ctrl-v and enter.
crazygringo 4y ago
Not only that, but I have three authenticator apps installed because each service only works with one (or select ones). But when I try to log in, they give no indication of which one I have to use. So I finally started annotating which one in my password manager, so it's a whole extra step to load up that as well, and then search for the app on my phone. Except it's worse: both the Google and Microsoft authenticators are just named "Authenticator", identically. At least the Google icon is a "G", but the Microsoft icon is so generic it could literally be any company. And then the Symantec Authenticator is randomly called "VIP Access", with zero indication it's by Symantec or that it's even an authenticator. And because I only use these things once a month or so, I'm re-baffled by it every time.
- js2 4y ago
  I’m not sure what the three are, but I was able to use Authy for all of my TOTP codes before I moved them all to the iOS/macOS keychain which now has TOTP support combined with autofill into the TOTP field in Safari. But in any case, what I wanted to let you know is that you can convert the Symantec VIP token into a standard TOTP token. https://github.com/dlenski/python-vipaccess https://github.com/dlenski/python-vipaccess
  - Macha 4y ago
    I have Blizzard, Steam, company Duo with push notifications as single purpose authenticators I don't have an alternative to. Also Square Enix though they have started letting you set up third party authenticators, I just haven't migrated yet. Then 10 or so accounts in Aegis for general 2fa (including both Microsoft and Google, it has to be said)
    - js2 4y ago
      Oh right, Duo. Those are apparently OATH HOTP codes with some propriety modifications[1]. I also have to use Duo for work but almost all of the time I acknowledge the push notification instead of use the code. Between Okta, Duo, Touch ID and a Yubikey it feels like I’m having to authenticate one way or another dozens of times a day, so I feel your pain there. But outside of work, all my personal TOTP codes are consolidated. 1. https://github.com/WillForan/duo-hotp https://github.com/WillForan/duo-hotp
theandrewbailey 4y ago
Have your password manager take care of TOTPs. Copy and paste. You're using a password manager with randomized passwords for your sites, services, and apps, right?

ok123456 4y ago

You don't need an app to do TOTP. You can do it from a command line if you have the secret.

dingaling 4y ago
And you could do it with pencil and paper if you wanted. If you were very quick at maths. The point is that it places a requirement on the user and interrupts their workflow when they just want to Get Stuff Done. And if it stops working then the burden is on the user to make it work again.
- ok123456 4y ago
  That's true of any authentication mechanism. It works until it doesn't. If you wanted to work this into a traditional terminal workflow "generateToken my.host && ssh my.host" TOPT is the least worst way of doing 2FA. I wish I lived in a world where this sort of thing wasn't necessary, but if you have a service where there are accounts that are worth a lot of money in the real world, you need to have some kind of 2FA.
throwawaaarrgh 4y ago
RSA SecurID requires their app for TOTP because they have some secret company seed, or something.
- ok123456 4y ago
  Probably some sad attempt at keeping their enterprise customers locked in.

unethical_ban 4y ago

We'll stop asking for a password, even! But honestly: If the "remember this session" button is checked as it often is for apps and sites, you should only have to do it every once in a while. Or, if the site is a bit more clever, you may only have to 2FA on sensitive screens, such as "edit personal data" or "make purchase" or "transfer money". The nice thing about "non-push" TOTP is that it does not require any external service. A site could generate its own TOTP keys, show you a QR code and let you use any app (Authy, 2FAone, Google Authenticator, etc) to manage those codes. And your phone can be offline and still work with it, and you can back up your own 2FA keys. "Push" based 2FA requires a service, typically paid, like Okta or RSA.

throwaway290 4y ago
> every once in a while Every time you change device or browser, for many services when you change your IP country, and many services limit the amount of remembered device sessions meaning you basically have to do it every day. Multiply by the number of services that force 2FA. Pray your VPN behavior or travel did not get you some hidden red flag.

CopOnTheRun 4y ago

Bitwarden can generate TOTPs that get copied to your clipboard after filling the username and password box for a website. Usually all that's required is an extra ctrl-v and enter.

crazygringo 4y ago

Not only that, but I have three authenticator apps installed because each service only works with one (or select ones). But when I try to log in, they give no indication of which one I have to use. So I finally started annotating which one in my password manager, so it's a whole extra step to load up that as well, and then search for the app on my phone. Except it's worse: both the Google and Microsoft authenticators are just named "Authenticator", identically. At least the Google icon is a "G", but the Microsoft icon is so generic it could literally be any company. And then the Symantec Authenticator is randomly called "VIP Access", with zero indication it's by Symantec or that it's even an authenticator. And because I only use these things once a month or so, I'm re-baffled by it every time.

js2 4y ago
I’m not sure what the three are, but I was able to use Authy for all of my TOTP codes before I moved them all to the iOS/macOS keychain which now has TOTP support combined with autofill into the TOTP field in Safari. But in any case, what I wanted to let you know is that you can convert the Symantec VIP token into a standard TOTP token. https://github.com/dlenski/python-vipaccess https://github.com/dlenski/python-vipaccess
- Macha 4y ago
  I have Blizzard, Steam, company Duo with push notifications as single purpose authenticators I don't have an alternative to. Also Square Enix though they have started letting you set up third party authenticators, I just haven't migrated yet. Then 10 or so accounts in Aegis for general 2fa (including both Microsoft and Google, it has to be said)
  - js2 4y ago
    Oh right, Duo. Those are apparently OATH HOTP codes with some propriety modifications[1]. I also have to use Duo for work but almost all of the time I acknowledge the push notification instead of use the code. Between Okta, Duo, Touch ID and a Yubikey it feels like I’m having to authenticate one way or another dozens of times a day, so I feel your pain there. But outside of work, all my personal TOTP codes are consolidated. 1. https://github.com/WillForan/duo-hotp https://github.com/WillForan/duo-hotp

theandrewbailey 4y ago

Have your password manager take care of TOTPs. Copy and paste. You're using a password manager with randomized passwords for your sites, services, and apps, right?