4 ms·
I have TOTP basically everywhere. The one place I didn’t have it and specifically didn’t want it was Gmail. My password is over thirty characters long and I kn
by donatj 3y ago
I have TOTP basically everywhere. The one place I didn’t have it and specifically didn’t want it was Gmail.
My password is over thirty characters long and I know it by heart. I really need access to my gmail even if I break my phone, and that happens every couple years. Usually it falls off my nightstand and I step on it getting out of bed. I also don’t like carrying my phone everywhere. I do now, because I have to, but I shouldn’t have to.
Being able to be at a friends house and just check my email on his laptop without carrying a special device seems beyond reasonable.
Anyway Google forced me to enable it because I publish a Chrome Extension and I’m still salty about it.
- platz 3y agoyou could memorize the TOTP secrets
- bonton89 3y agoIs it possible to create a second Google account to use just for the Chrome Extension? I've heard that Google will sometimes demand you login from a known device anyway regardless of settings as a form of unexpected 2FA although I haven't experienced it myself.
- remram 3y ago> Being able to be at a friends house and just check my email on his laptop without carrying a special device seems beyond reasonable. That is exactly what MFA is supposed to protect against: other devices being unprotected. Anyway you could look into a physical device like a yubikey that is easier to carry around and harder to break.
- reaperman 3y agoI have the same reservation about 2FA on Gmail, but an account takeover would be too devastating to me not to have it. My middle-ground is having multiple printouts of the 8 "backup codes" that can be used if my phone breaks. I suppose connecting some yubikeys to it and having those scattered around my home/backpack/car would also be a good additional backup as well.
- mysteria 3y agoIt's always good to have a backup email account with no 2FA/geolockouts for emergency use. I keep a backup Keepass file stored in that account which contains my TOTP secrets and other passwords to bootstrap myself if the worst happens.
- ArtemZ 3y ago> I have TOTP basically everywhere. Not on HN, though.
- aspenmayer 3y agoaaaand now the post is flagged lol
- Ferret7446 3y agoTOTP is not 2FA though (depending on how you define 2FA). Something you know, something you have, something you are. TOTP is a seed that you know. Together with your password which is also something that you know, you have one factor. Also, if your password is 30 characters long, it sounds like you're using a single password for all of your services. Don't do that; you are 100% fucked if any one service you use gets compromised.
- Izkata 3y agoTOTP falls under "something you have" because the secret isn't transferred and you don't (generally) have access to it to leak it.
- Ferret7446 3y agoThe secret is literally transferred when you first set it up encoded in plaintext in a QR code, and then again, as I expect most here use a service like Authy. Unless you're using a device that already implements true 2FA like a Yubikey, it is generally trivial to pull out the seed (e.g., Google Authenticator app).