5 ms·
This. For me a TOTP app/tool will only ever output codes. If it offers to let me do anything else with the key, it's a no-go.
by ris 3y ago
This. For me a TOTP app/tool will only ever output codes. If it offers to let me do anything else with the key, it's a no-go.
- bombolo 3y agoSo what do you do when your phone falls down and breaks?
- obarthelemy 3y agoI take my previous phone out of its drawer. Or my tablet.
- bombolo 3y agoVery funny. But how do you login into things without the otp seed?
- iavael 3y agoUse another device with _another_ seed (since this is auth factor of ownership you must not share seed between multiple devices just like pki private keys and pgp keys). Or if you don't have backup otp generator then use backup codes.
- obarthelemy 3y agoIt's standalone 2FA, not a paswword manager. There's no seed.
- bombolo 3y agoOooooh, you don't understand how google authenticator works!
- obarthelemy 3y agoTry it: it works offline.
- bombolo 3y agoIt doesn't work from a broken phone.
- ris 3y agoAccount recovery codes & other means of backup authentication until I can generate new MFA tokens. It's really not a big deal, whereas it looks like the next big cloud hack will be.