4 ms·
Meanwhile a bunch of crappy apps like $BANK1 use Symantec's implementation which is just TOTP with extra steps (there's a Python script out there that masquerad
by toastal 3y ago
Meanwhile a bunch of crappy apps like $BANK1 use Symantec's implementation which is just TOTP with extra steps (there's a Python script out there that masquerades like a macOS device to get you the raw TOTP code) and $BANK2 & $BANK3 only allow TOTP inside their application (security through obscurity). Icing the cake, most that prompt for a third-party option say something like “Scan the code with Google™ Authenicator™” instead of using a generic term. Why is it so _hard_ for folks to support generic TOTP?
- sebk 3y agoFortunately you can undo these steps for $BANK1 and use your TOTP authenticator of choice: https://github.com/dlenski/python-vipaccess https://github.com/dlenski/python-vipaccess e: I think you added a reference to this as I was writing my comment :)
- toastal 3y agoI did sneak that in after the post, but thanks for the link to those that didn't know about it.
- omoikane 3y agoI think that spoofs Symantec's app, so while it allows an undesirable app to be avoided, it doesn't eliminate communication with an undesirable third party.
- playingalong 3y agoTOTP don't require communication with issuer, including Symantec here.
- omoikane 3y agoMy apologies, I guess I read these bits wrong. https://github.com/dlenski/python-vipaccess/blob/cc4366f7bce41d5ebce64ae8d86cc71e5eda5703/vipaccess/provision.py#L41 https://github.com/dlenski/python-vipaccess/blob/cc4366f7bce... https://github.com/dlenski/python-vipaccess/issues/39#issuecomment-628741743 https://github.com/dlenski/python-vipaccess/issues/39#issuec...