4 ms·

I'm not giving reddit my phone number, I get enough junk calls as it is. Edit: Reads comment by Maxburn, googles TOTP and Authy Why the heck do I need a 3rd p

I'm not giving reddit my phone number, I get enough junk calls as it is. Edit: Reads comment by Maxburn, googles TOTP and Authy Why the heck do I need a 3rd party involved? Ugh

Maxburn 4y ago
It's actually TOTP so I stuck that in Authy.
deleted 4y ago
[deleted]
corobo 4y ago
You're welcome to calculate the code yourself by hand! Those apps keep track of it for you, you can use any 2FA app that supports TOTP. You could even make your own if you want. https://en.wikipedia.org/wiki/Time-based_one-time_password https://en.wikipedia.org/wiki/Time-based_one-time_password
- Maxburn 4y ago
  This was my first thought after OP edit, lol, good luck doing this all yourself under the time limit. OP needs to educate themselves on 2FA methods. Google authenticator exists, but I'm trying to get google out of my life. I think Bitwarden has one. I'm only using Authy because it was among the first to offer a backup/restore solution that I stumbled on.
dicknuckle 4y ago
No 3rd party is involved. You're localizing the 2nd factor of authentication. Google could burn down tomorrow andb cease to exist, you could still use authenticator. It's a cryptographic verification scheme, not a service. RSA was a big one that was similar. Not sure if it's still used today but there was a little hardware fob that wasn't connected to the internet or anything, the whole thing works on Time. The only thing that fob needed was a constant battery power, if it died you'd have to replace the battery and call the helpdesk to get it resynced with your account. The only thing your phone needs is a good time source like GPS or network time. I believe authenticator app works even if your phone doesn't have service. You could be on a landline in a remote region with no Internet, talking to your significant other on the other side of the world, have them log in to your account and give them the code displayed by the authenticator app and they could send that important email you forgot.
- andylynch 4y ago
  RSA SecurId - big problem with that was RSA had the tokens’ seeds, as well as their customers. Recalling all their customers’ tokens after getting hacked back in 2011 must have been expensive.
  - dicknuckle 4y ago
    Big oooof, wasn't aware of that. I believe TOTP works much differently based on my CLI interaction with it, but an expert would need to confirm.
philjohn 4y ago
You don't. Have a look at Yubikey's - there, the seed is stored on the key itself, the calculation done on the key itself, and all the app does is read it all via NFC.
- Maxburn 4y ago
  I just spent a minute and I'm having trouble wrapping my head around TOTP challenges with yubikey. Like scanning the QR to get the key in it, how do you query it to answer the challenge etc. Must be an app involved?
  - philjohn 4y ago
    Sorry, didn't see this until now. Yes, you use the Yubico Authenticator app, but it's entirely local only (runs fine with all networking switched off). It's available for Mac, Linux and Windows, as well as Android and iOS. On computers your key needs to be inserted into a USB port. For Android and iOS I use the NFC key and I just scan it against the phone after launching the app.

I'm not giving reddit my phone number, I get enough junk calls as it is. Edit: Reads comment by Maxburn, googles TOTP and Authy Why the heck do I need a 3rd party involved? Ugh

Maxburn 4y ago

It's actually TOTP so I stuck that in Authy.

deleted 4y ago

[deleted]

corobo 4y ago

You're welcome to calculate the code yourself by hand! Those apps keep track of it for you, you can use any 2FA app that supports TOTP. You could even make your own if you want. https://en.wikipedia.org/wiki/Time-based_one-time_password https://en.wikipedia.org/wiki/Time-based_one-time_password

Maxburn 4y ago
This was my first thought after OP edit, lol, good luck doing this all yourself under the time limit. OP needs to educate themselves on 2FA methods. Google authenticator exists, but I'm trying to get google out of my life. I think Bitwarden has one. I'm only using Authy because it was among the first to offer a backup/restore solution that I stumbled on.

dicknuckle 4y ago

No 3rd party is involved. You're localizing the 2nd factor of authentication. Google could burn down tomorrow andb cease to exist, you could still use authenticator. It's a cryptographic verification scheme, not a service. RSA was a big one that was similar. Not sure if it's still used today but there was a little hardware fob that wasn't connected to the internet or anything, the whole thing works on Time. The only thing that fob needed was a constant battery power, if it died you'd have to replace the battery and call the helpdesk to get it resynced with your account. The only thing your phone needs is a good time source like GPS or network time. I believe authenticator app works even if your phone doesn't have service. You could be on a landline in a remote region with no Internet, talking to your significant other on the other side of the world, have them log in to your account and give them the code displayed by the authenticator app and they could send that important email you forgot.

andylynch 4y ago
RSA SecurId - big problem with that was RSA had the tokens’ seeds, as well as their customers. Recalling all their customers’ tokens after getting hacked back in 2011 must have been expensive.
- dicknuckle 4y ago
  Big oooof, wasn't aware of that. I believe TOTP works much differently based on my CLI interaction with it, but an expert would need to confirm.

philjohn 4y ago

You don't. Have a look at Yubikey's - there, the seed is stored on the key itself, the calculation done on the key itself, and all the app does is read it all via NFC.

Maxburn 4y ago
I just spent a minute and I'm having trouble wrapping my head around TOTP challenges with yubikey. Like scanning the QR to get the key in it, how do you query it to answer the challenge etc. Must be an app involved?
- philjohn 4y ago
  Sorry, didn't see this until now. Yes, you use the Yubico Authenticator app, but it's entirely local only (runs fine with all networking switched off). It's available for Mac, Linux and Windows, as well as Android and iOS. On computers your key needs to be inserted into a USB port. For Android and iOS I use the NFC key and I just scan it against the phone after launching the app.