3 ms·
Tell HN: You can add a 2FA account to multiple authenticator apps
I thought this was an important redundancy that I didn't know was possible until today.
You can scan your enrolment QR code with multiple authenticators (like Authy and MS Authenticator, for example).
And the codes are synced between the two.
I guess that means that 2FA has to be implemented as a time-synced secure hash iteration, based on a secret nonce and time code embedded in the QR code, and the algorithm outputs a 1e6 to 1e8 space of entropy for each code, maybe from the low bits of the last hash?
The majority is always kept secret so that's where the non-predictability comes from, it's like generating an endless sequence of "pseudo-random" OTPs using a hash as a keystream generator?
This is also an Ask HN! Is that how it works?
- stephenr 2y agoThe first T in TOTP stands for “Time”. If a site used HOTP for their 2FA OTP, it wouldn’t work afaik as it’s counter based.
- keepamovin 2y agoDid know know that about TOTP! But as long as the counters increment at the same rate which presumably they would? For enrollment scan the same QR code for two different apps. Or is that not getting it?
- stephenr 2y agoI haven't used HOTP, but my (very basic) understanding is that it works by having both sides (the service and the OTP generator) increment a count. If you have two OTP generators configured, you'd have to "request" a new OTP from each of them every time you use one, to keep them in sync.
- keepamovin 2y agoMakes sense, thanks! I will look more into it. Thankfully, so far it seems my providers are not using it.
- stephenr 2y agoYeah, I've never seen it used for 2FA OTPS, but apparently it's used by some hardware tokens.
- keepamovin 2y agoAh, that's interesting! I Have never been able to figure those hardware tokens out. Sometimes when 2FA comes up I will click "Use your security key" thinking it is going to be a passkey/biometric or authenticator. Nope! It is some kind of USB stick that folks like Bloomberg traders use.
- scrapheap 2y agoPretty much, they're usually based on shared secrets and the current time. Check out https://en.wikipedia.org/wiki/Time-based_one-time_password https://en.wikipedia.org/wiki/Time-based_one-time_password and https://en.wikipedia.org/wiki/HMAC-based_one-time_password https://en.wikipedia.org/wiki/HMAC-based_one-time_password for some of the finer details
- keepamovin 2y agoCool thank you :)
- langcss 2y agoYou can also bulk export all codes from Google Authenticator as a single QR code and scan to another device which is a convenient way to back up.
- keepamovin 2y agoThat is convenient! Thanks
- mindwork 2y agoI've got a bug once where 2FA code didn't work after I moved to a different timezone(from PST moved to GMT+1). It was working again after I moved back to my original timezone. Every other code worked perfectly except this one. It was for Intuit account. Can someone explain how did this happen?
- solardev 2y agoFYI, you can also add your 2FA to cloud password managers like Bitwarden or 1password, and that way it will work across all your devices without having to pull out your phone. My 1password just autofills the 2FA requests on my laptop, for example. Passkeys are similar. They can be implemented in software and don't need to be tied to a physical device. This does decrease security somewhat ("something you know and something you have" becomes "two things someone else knows, protected by one thing you know -- your master password"). But it's a lot more convenient than having to pull up the 2FA app on your phone all the time, and there's no worries about losing any devices since you can just log back in on a replacement and all your 2FAs are still there.