3 ms·
That’s a fun little Easter egg! It’s always cool to see small details like this that add some personality to otherwise routine tasks. Makes me wonder what other
by a_tyler_ 2y ago
That’s a fun little Easter egg! It’s always cool to see small details like this that add some personality to otherwise routine tasks. Makes me wonder what other quirky things could be hidden in security tools without compromising functionality.
- jakey_bakey 2y agoThe password manager that... writes very short puns!
- jonas21 2y agoI love Easter eggs -- but security tools are the last place I want them showing up. Like do you really want to entrust your TOTP secrets to a random app by a guy you've never met just to get some fun push notifications?
- hiatus 2y agoTOTP seeds are only useful if you have the account they are associated with. How would the 2fa app by some random guy discern the identity associated with the seed?
- TZubiri 2y agoIt's not even worth the thought.
- jonas21 2y agoTo add an item, you scan a QR code. That QR code usually contains the name of the service and your username. For example, the format of Github's QR code is: otpauth://totp/GitHub:[username]?secret=[secret]&issuer=GitHub
- jakey_bakey 2y agoYeah this seed is what’s stored on Keychain
- freehorse 2y agoWhat? The same way that when you look at the 2fa codes in your app you know which account they are associated with. The qr codes people typically scan for that do not just contain the seed itself but metadata for the account associated with it like email address or account name.
- hiatus 2y agoI had a similar concern when I used a random app for TOTP on my garmin watch, but was relieved when I considered the point I raised. To add codes to the watch you have to paste a seed into an app, and it couldn't be triggered from a QR code. I didn't realize the scan for 2fa had so much info.
- xp84 2y agoIsn't one issue the display of the codes on the lockscreen? If viewing notification contents there is enabled, it would be problematic if it popped up while you were away from your device to say "Your Google 2fa is 100000 right now". I get that the iOS default requires unlock to view the actual content of the notification, but still, that seems less than perfect from a security standpoint. Still the app is fun and I appreciate it.
- jakey_bakey 2y agoNotifications say nothing about the account - just that you got this cool number on the app. And yeah you need the device unlocked to read the notification anyway But yeah security concerns with it are overblown, the more realistic concern is trusting me personally vs a name brand!