6 ms·

Regular reminder for Apple users that iOS/MacOS has support for TOTP codes out of the box. It fills the code like an autocomplete. https://support.apple.com/en

by divan 3y ago

Regular reminder for Apple users that iOS/MacOS has support for TOTP codes out of the box. It fills the code like an autocomplete. https://support.apple.com/en-gb/guide/iphone/ipha6173c19f/ios https://support.apple.com/en-gb/guide/iphone/ipha6173c19f/io...

tough 3y ago
So are you telling me you can just use vanilla iOS to store TOTP like with Authy or Google's Authneticator or 1PAssword but directly into the apple keychain? That seems nice Honestly I think apple could do a better job at camera -> qr ux flow
- Eric_WVGG 3y ago
  Yup. The catch is, it's kind of buried in System Settings. Cable Sasser wrote a blog post that was making the rounds a few weeks ago, advocating for a dedicated app. He's right, the existing Apple implementation works great but it's still a lot for normies. https://cabel.com/2023/03/27/apple-passwords-deserve-an-app/ https://cabel.com/2023/03/27/apple-passwords-deserve-an-app/
- xp84 3y ago
  > camera -> qr ux flow You mean the idiotic little tiny yellow popup which only stays on the screen while the QR in view and must be tapped to activate... WTF were they thinking right? (You can add a "QR reader" button to your control center though which functions in a more sane way.) Anyway yes you can do that, but I wouldn't use iCloud keychain at all because your Apple account, including ICKC, can be fully hijacked using one factor only - the passcode of the device an attacker has. People watch you unlocking in a bar, then grab your phone and run. Google "joanna stern iphone passcode" before moving any precious data into Apple's control.
  - divan 3y ago
    Thanks for the Joanna Stern story, didn't know that. But if an attacker has your iPhone with passcode they surely get access to your Google Authenticator or Auth app. How "not storing TOTP keys in iCloud" way is better in this case?
    - xp84 3y ago
      Great question! You prompted me to experiment. I'm afraid you're right. I previously thought that my authenticator, Microsoft Authenticator (MSA), was taking advantage of the feature that banking apps use where it could detect that a biometric was updated (Finger added / Face added) and clear stored credentials in that case, meaning that it could only unlock credentials with the actual face that saved them. Well, I was wrong. Holding my thumb over the face sensors twice yields an "Enter passcode" prompt which unlocks MSA. I assume Google Authenticator does the same. Just reinforces how thoroughly compromised you are if that single 6-digit code gets shoulder-surfed. facepalm Note: I'm assuming the reason MS and Google made this choice is that since sync was added later (a few years ago for MS and this week for Google), if they did the secure thing which is technically to self-destruct all your keys if you've altered your biometrics, this would mean that a simple redo of your face scan or adding a finger would lose all your TOTPs, because there was not a fall-back password or something that secured those apps. So I guess perhaps a more secure solution in this situation is 1Password? Because with that, if you can't pass Face ID, you'd have to enter your master 1pw key which hopefully nobody knows or can guess.
  - Eduard 3y ago
    > Google "joanna stern iphone passcode" https://www.wsj.com/articles/apple-iphone-security-theft-passcode-data-privacya-basic-iphone-feature-helps-criminals-steal-your-digital-life-cbf14b1a https://www.wsj.com/articles/apple-iphone-security-theft-pas... https://archive.is/tn9aq https://archive.is/tn9aq TL;DR: if someone spies out your iPhone's passcode, they may be able to hijack other accounts synchronized with it. In such situations, this simple passcode is like a master password, with with critical things such as PayPal and Apple Pay payments can be initiated to drain bank accounts. Two-factor authentication also doesn't help, as their challenges can be approved easily once the iPhone is unlocked with the passcode.
  - bobbylarrybobby 3y ago
    Actually apple updated it so that when you lose sight of the QR code, the link gets moved to the bottom center of the screen, where it stays for a while. Why it's not always positioned there, I don't know. Having to chase a moving target on your screen is some real dumb design.
- nashashmi 3y ago
  It does do that. Point and aim camera at totp QR code and it will ask to which account you want to store it to.
nashashmi 3y ago
Lol. I remember the user who said to me "documentation or it doesn't exist". And so I looked it up. Became pretty popular on hn.
abareplace 3y ago
You need to store the password on the iPhone in this case, which is insecure. The whole point of having the second-factor auth is using two separate devices: a computer stores the password (in a password manager) and a smartphone generates the TOTP codes.

by divan 3y ago

tough 3y ago

So are you telling me you can just use vanilla iOS to store TOTP like with Authy or Google's Authneticator or 1PAssword but directly into the apple keychain? That seems nice Honestly I think apple could do a better job at camera -> qr ux flow

Eric_WVGG 3y ago
Yup. The catch is, it's kind of buried in System Settings. Cable Sasser wrote a blog post that was making the rounds a few weeks ago, advocating for a dedicated app. He's right, the existing Apple implementation works great but it's still a lot for normies. https://cabel.com/2023/03/27/apple-passwords-deserve-an-app/ https://cabel.com/2023/03/27/apple-passwords-deserve-an-app/
xp84 3y ago
> camera -> qr ux flow You mean the idiotic little tiny yellow popup which only stays on the screen while the QR in view and must be tapped to activate... WTF were they thinking right? (You can add a "QR reader" button to your control center though which functions in a more sane way.) Anyway yes you can do that, but I wouldn't use iCloud keychain at all because your Apple account, including ICKC, can be fully hijacked using one factor only - the passcode of the device an attacker has. People watch you unlocking in a bar, then grab your phone and run. Google "joanna stern iphone passcode" before moving any precious data into Apple's control.
- divan 3y ago
  Thanks for the Joanna Stern story, didn't know that. But if an attacker has your iPhone with passcode they surely get access to your Google Authenticator or Auth app. How "not storing TOTP keys in iCloud" way is better in this case?
  - xp84 3y ago
    Great question! You prompted me to experiment. I'm afraid you're right. I previously thought that my authenticator, Microsoft Authenticator (MSA), was taking advantage of the feature that banking apps use where it could detect that a biometric was updated (Finger added / Face added) and clear stored credentials in that case, meaning that it could only unlock credentials with the actual face that saved them. Well, I was wrong. Holding my thumb over the face sensors twice yields an "Enter passcode" prompt which unlocks MSA. I assume Google Authenticator does the same. Just reinforces how thoroughly compromised you are if that single 6-digit code gets shoulder-surfed. facepalm Note: I'm assuming the reason MS and Google made this choice is that since sync was added later (a few years ago for MS and this week for Google), if they did the secure thing which is technically to self-destruct all your keys if you've altered your biometrics, this would mean that a simple redo of your face scan or adding a finger would lose all your TOTPs, because there was not a fall-back password or something that secured those apps. So I guess perhaps a more secure solution in this situation is 1Password? Because with that, if you can't pass Face ID, you'd have to enter your master 1pw key which hopefully nobody knows or can guess.
- Eduard 3y ago
  > Google "joanna stern iphone passcode" https://www.wsj.com/articles/apple-iphone-security-theft-passcode-data-privacya-basic-iphone-feature-helps-criminals-steal-your-digital-life-cbf14b1a https://www.wsj.com/articles/apple-iphone-security-theft-pas... https://archive.is/tn9aq https://archive.is/tn9aq TL;DR: if someone spies out your iPhone's passcode, they may be able to hijack other accounts synchronized with it. In such situations, this simple passcode is like a master password, with with critical things such as PayPal and Apple Pay payments can be initiated to drain bank accounts. Two-factor authentication also doesn't help, as their challenges can be approved easily once the iPhone is unlocked with the passcode.
- bobbylarrybobby 3y ago
  Actually apple updated it so that when you lose sight of the QR code, the link gets moved to the bottom center of the screen, where it stays for a while. Why it's not always positioned there, I don't know. Having to chase a moving target on your screen is some real dumb design.
nashashmi 3y ago
It does do that. Point and aim camera at totp QR code and it will ask to which account you want to store it to.

nashashmi 3y ago

Lol. I remember the user who said to me "documentation or it doesn't exist". And so I looked it up. Became pretty popular on hn.

abareplace 3y ago

You need to store the password on the iPhone in this case, which is insecure. The whole point of having the second-factor auth is using two separate devices: a computer stores the password (in a password manager) and a smartphone generates the TOTP codes.