4 ms·

Github 2FA is made extra fun because they only offer a single mechanic of replacing it (that I know of), and that's using the recovery codes. So, they forced m

Github 2FA is made extra fun because they only offer a single mechanic of replacing it (that I know of), and that's using the recovery codes. So, they forced me to use 2FA, and I dutifully printed out the recovery codes (don't write down your passwords, that's bad practice, but here's 20 recovery codes that stand between you and losing your account forever, so you know, manage that somehow). When I bought a new iPhone, apparently none of my stored information got copied over. The apps did, but none of the information for those apps (for example, the TOTP info maintained by the authenticator I used). So, I went to log in to Github, opened up my authenticator app, and it was blank. Thankfully I had the codes...back at home, in a drawer, guarded by a cat, so I wasn't completely doomed, but it ruined the day to be sure until I could get home and recover it and recalibrate my TOTP app. Oh, guess who has a photo of their recovery codes on their phone now?

ta1243 3y ago
TOTP backups from phones is a major issue, from what I can tell you simply can't do it.
- smallpipe 3y ago
  With a yubikey everything is stored on the key and the phone is just a terminal, so it travels between phones. Now if you lose the key that's another issue :)
  - ta1243 3y ago
    Sure, so same problem. Less likely your yubikey will be stolen I guess, but less convenient too (something else to carry)
    - deleted 3y ago
      [deleted]
    - tnbp 3y ago
      But it's a key though. It goes on the keychain. Unless you don't carry around keys either, in which case yes, that would be very inconvenient indeed. Also, your Yubikey is probably less likely to be stolen or break, but I figure it's much easier to lose it, which is why you might want to have two, just in case. And that's where it gets really inconvenient.
      - lannisterstark 3y ago
        >But it's a key though. It goes on the keychain. Unless you don't carry around keys either, in which case yes, that would be very inconvenient indeed. Half the time I choose for TOTP authentication over Yubikey because "Oh god it's in the living room I don't want to go get it." I do have a backup key mind, but that's USB-C instead of A. Maybe I should make another USB A backup.
      - hot_gril 3y ago
        Two yubikeys sounds ok, but I don't 100% trust that the second one works forever. Anyway, my keychain got ran over by a bus, and luckily the yubikey survived.
      - filleokus 3y ago
        The problem I've always had with the two yubikey-model (except for cost an inconvenience of course) is that you can't really keep the second key in cold storage, because you need to enroll it to new accounts. That doesn't happen every day, but probably regularly enough that you can't keep in a bank vault or something. On the other hand, you know the second one works and haven't spontaneously bitrotted. My nerdy preferred version would have been (pre-passkey) to have a hardware token where the root secret is generated out-of-device and exist on e.g a paper backup or something. Then I could just buy a new hardware token and inject the same token if the device dies.
        tnbp 3y ago
        You can technically do this with TOTP if you save the secret instead of simply enrolling the account. You're not supposed to do that, though.
- 369548684892826 3y ago
  2FAS [0] and I think Authy [1] as well have options for backing up your TOTP config 0: https://apps.apple.com/us/app/2fa-authenticator-2fas/id1217793794 https://apps.apple.com/us/app/2fa-authenticator-2fas/id12177... 1: https://apps.apple.com/us/app/twilio-authy/id494168017 https://apps.apple.com/us/app/twilio-authy/id494168017
- hot_gril 3y ago
  It's the Google Authenticator app's fault. The most popular TOTP app probably, and for a long time, they were saying it's intentionally designed not to let you copy the codes. Now you can, but there are lots of pitfalls and vague documentation. I'm not convinced that TOTP is a user-friendly design to begin with, but it didn't have to be this bad. I don't fw TOTP now. There are other apps, but I'm done. I'll only use it if the iPhone Keychain has built-in support some day.
  - eppsilon 3y ago
    The iOS Keychain already supports TOTP.
    - hot_gril 3y ago
      Ah yeah, it's hidden away a little cause they don't call it TOTP and you need to manually copy codes into your settings app. Gonna see if I can set it up on Mac cause that's where I'll actually maybe need it.
      - Willamin 3y ago
        Set up should be simpler than needing to manually copy codes into your settings app. When a QR code is present on screen that resolves to a TOTP seed, an additional context menu option should be present to "Add Verification Code in Passwords" or "Set Up Verification Code" or similar. Here's a screenshot I nabbed from a way-too-wordy article on the subject: https://tidbits.com/uploads/2021/10/Add-Verification-Code-1536x1195.jpg https://tidbits.com/uploads/2021/10/Add-Verification-Code-15...
- justanorherhack 3y ago
  Use ravio on io’s, lets you copy, backup and duplicate them to other places.
- MrDrMcCoy 3y ago
  That's why I store them in Bitwarden.
- Vinnl 3y ago
  Oh huh, I switched from AndOTP to Aegis and was able to export from the former and import into the latter. Then on desktop I'm using Authenticator [0], which can import from both. [0] https://flathub.org/apps/com.belmoussaoui.Authenticator https://flathub.org/apps/com.belmoussaoui.Authenticator
- lannisterstark 3y ago
  >TOTP backups from phones is a major issue, from what I can tell you simply can't do it. I've done it in Aegis multiple times. They even allow you to export the 'database' (which iirc is just an encrypted json file)
- tzs 3y ago
  What I do is when I receive a QR code to set up TOTP while creating a new account is to take a screenshot of that code and save an encrypted copy of that screenshot. Then it is just part of my ordinary data backed up as part of my normal backups. If I ever want to set up a TOTP app on a new device it is not hard to decrypt all my saved QR codes, open them all at the same time in Preview on my Mac, select the option to show one page at a time, and then get into a nice rhythm using one hand to scan on the new device and the other to hit "page down" on the Mac keyboard. If the site also gives a text form of the shared secret from the QR code I save that too. Having the text form around is handy in case I need to login but for some reason don't have the devices where I have the TOTP apps. Given the text form of the code, this command, from the oathtool package, will give the current login code: $ oathtool --totp -b "secret" That's if the secret is encoded in base32, which they commonly are. If it is in hex leave off the -b. If the site doesn't give a text form of the shared secret I read the QR code to get it. If you do that be careful. Some QR code reader apps do the processing server side which you probably don't want...and they don't necessarily make that clear in the description. I had to try a couple of apps from the Mac app store before finding one that did it client side. (Then I found out that Mathematica's BarcodeRecognize function can do it, and deleted the QR code reader app. Now I just open Mathematica, type BarcodeRecognize[], drag and drop an image file that has the QR code between the brackets, and hit shift-return).
  - hot_gril 3y ago
    Why use a QR code reader app instead of the built in camera app? Personally, I email the backup codes to myself. Yes it's less secure in theory, but the only time I'm using totp is against my will.
    - tzs 3y ago
      > Why use a QR code reader app instead of the built in camera app? The QR code is on the screen of my desktop Mac. The camera is right above the screen facing me and can't see what is on the screen. I could read it with the built in camera app on my iPhone or iPad, but that just tells me it is a QR code for the TOTP authenticator app I use and opens that if I tap. I don't see a way to get it to tell me the content of the QR code in text form. Even if it had a way that would be on the phone and I want the text to save it on the Mac.
- shortsunblack 3y ago
  Use Aegis.
samcat116 3y ago
there are other methods for 2fa recovery. The main one involves an SSH key you've previously added to your account.
- qhwudbebd 3y ago
  Using said ssh key as one of the 2fa choices for standard login would be quite a nice feature too...

ta1243 3y ago

TOTP backups from phones is a major issue, from what I can tell you simply can't do it.

smallpipe 3y ago
With a yubikey everything is stored on the key and the phone is just a terminal, so it travels between phones. Now if you lose the key that's another issue :)
- ta1243 3y ago
  Sure, so same problem. Less likely your yubikey will be stolen I guess, but less convenient too (something else to carry)
  - deleted 3y ago
    [deleted]
  - tnbp 3y ago
    But it's a key though. It goes on the keychain. Unless you don't carry around keys either, in which case yes, that would be very inconvenient indeed. Also, your Yubikey is probably less likely to be stolen or break, but I figure it's much easier to lose it, which is why you might want to have two, just in case. And that's where it gets really inconvenient.
    - lannisterstark 3y ago
      >But it's a key though. It goes on the keychain. Unless you don't carry around keys either, in which case yes, that would be very inconvenient indeed. Half the time I choose for TOTP authentication over Yubikey because "Oh god it's in the living room I don't want to go get it." I do have a backup key mind, but that's USB-C instead of A. Maybe I should make another USB A backup.
    - hot_gril 3y ago
      Two yubikeys sounds ok, but I don't 100% trust that the second one works forever. Anyway, my keychain got ran over by a bus, and luckily the yubikey survived.
    - filleokus 3y ago
      The problem I've always had with the two yubikey-model (except for cost an inconvenience of course) is that you can't really keep the second key in cold storage, because you need to enroll it to new accounts. That doesn't happen every day, but probably regularly enough that you can't keep in a bank vault or something. On the other hand, you know the second one works and haven't spontaneously bitrotted. My nerdy preferred version would have been (pre-passkey) to have a hardware token where the root secret is generated out-of-device and exist on e.g a paper backup or something. Then I could just buy a new hardware token and inject the same token if the device dies.
      - tnbp 3y ago
        You can technically do this with TOTP if you save the secret instead of simply enrolling the account. You're not supposed to do that, though.
369548684892826 3y ago
2FAS [0] and I think Authy [1] as well have options for backing up your TOTP config 0: https://apps.apple.com/us/app/2fa-authenticator-2fas/id1217793794 https://apps.apple.com/us/app/2fa-authenticator-2fas/id12177... 1: https://apps.apple.com/us/app/twilio-authy/id494168017 https://apps.apple.com/us/app/twilio-authy/id494168017
hot_gril 3y ago
It's the Google Authenticator app's fault. The most popular TOTP app probably, and for a long time, they were saying it's intentionally designed not to let you copy the codes. Now you can, but there are lots of pitfalls and vague documentation. I'm not convinced that TOTP is a user-friendly design to begin with, but it didn't have to be this bad. I don't fw TOTP now. There are other apps, but I'm done. I'll only use it if the iPhone Keychain has built-in support some day.
- eppsilon 3y ago
  The iOS Keychain already supports TOTP.
  - hot_gril 3y ago
    Ah yeah, it's hidden away a little cause they don't call it TOTP and you need to manually copy codes into your settings app. Gonna see if I can set it up on Mac cause that's where I'll actually maybe need it.
    - Willamin 3y ago
      Set up should be simpler than needing to manually copy codes into your settings app. When a QR code is present on screen that resolves to a TOTP seed, an additional context menu option should be present to "Add Verification Code in Passwords" or "Set Up Verification Code" or similar. Here's a screenshot I nabbed from a way-too-wordy article on the subject: https://tidbits.com/uploads/2021/10/Add-Verification-Code-1536x1195.jpg https://tidbits.com/uploads/2021/10/Add-Verification-Code-15...
justanorherhack 3y ago
Use ravio on io’s, lets you copy, backup and duplicate them to other places.
MrDrMcCoy 3y ago
That's why I store them in Bitwarden.
Vinnl 3y ago
Oh huh, I switched from AndOTP to Aegis and was able to export from the former and import into the latter. Then on desktop I'm using Authenticator [0], which can import from both. [0] https://flathub.org/apps/com.belmoussaoui.Authenticator https://flathub.org/apps/com.belmoussaoui.Authenticator
lannisterstark 3y ago
>TOTP backups from phones is a major issue, from what I can tell you simply can't do it. I've done it in Aegis multiple times. They even allow you to export the 'database' (which iirc is just an encrypted json file)
tzs 3y ago
What I do is when I receive a QR code to set up TOTP while creating a new account is to take a screenshot of that code and save an encrypted copy of that screenshot. Then it is just part of my ordinary data backed up as part of my normal backups. If I ever want to set up a TOTP app on a new device it is not hard to decrypt all my saved QR codes, open them all at the same time in Preview on my Mac, select the option to show one page at a time, and then get into a nice rhythm using one hand to scan on the new device and the other to hit "page down" on the Mac keyboard. If the site also gives a text form of the shared secret from the QR code I save that too. Having the text form around is handy in case I need to login but for some reason don't have the devices where I have the TOTP apps. Given the text form of the code, this command, from the oathtool package, will give the current login code: $ oathtool --totp -b "secret" That's if the secret is encoded in base32, which they commonly are. If it is in hex leave off the -b. If the site doesn't give a text form of the shared secret I read the QR code to get it. If you do that be careful. Some QR code reader apps do the processing server side which you probably don't want...and they don't necessarily make that clear in the description. I had to try a couple of apps from the Mac app store before finding one that did it client side. (Then I found out that Mathematica's BarcodeRecognize function can do it, and deleted the QR code reader app. Now I just open Mathematica, type BarcodeRecognize[], drag and drop an image file that has the QR code between the brackets, and hit shift-return).
- hot_gril 3y ago
  Why use a QR code reader app instead of the built in camera app? Personally, I email the backup codes to myself. Yes it's less secure in theory, but the only time I'm using totp is against my will.
  - tzs 3y ago
    > Why use a QR code reader app instead of the built in camera app? The QR code is on the screen of my desktop Mac. The camera is right above the screen facing me and can't see what is on the screen. I could read it with the built in camera app on my iPhone or iPad, but that just tells me it is a QR code for the TOTP authenticator app I use and opens that if I tap. I don't see a way to get it to tell me the content of the QR code in text form. Even if it had a way that would be on the phone and I want the text to save it on the Mac.
shortsunblack 3y ago
Use Aegis.

samcat116 3y ago

there are other methods for 2fa recovery. The main one involves an SSH key you've previously added to your account.

qhwudbebd 3y ago
Using said ssh key as one of the 2fa choices for standard login would be quite a nice feature too...