Hacker News Reader

Comment by woodruffw | Hacker News Reader

Hey! Implementor here.

> As far as I could tell, the only way to provision an application was through a mobile phone app.

Any application that knows how to ingest an otpauth:// URL and generate TOTP tokens will work. I know that 1Password on macOS does, and I suspect that other desktop password managers also have TOTP support.

> I don't have anything that can scan a QR code.

If you open the HTML for the TOTP provisioning page, you'll find the raw otpauth:// URL in an "aria-label" attribute on the QR image. That's obviously not very user friendly, and will be improved upon.

View on HN

Thanks! Perhaps people like me (never used TOTP outside of my bank's security token; don't have a smart phone; no experience with password managers) are common enough to mention this in the FAQ?

As it is, even though 1Password is only $3/month, the handful of projects I have on PyPI aren't revenue generating and I only make about one update a year, so I'm unlikely to switch to that just to manage PyPI entries.

Which means figuring out what the no cost solutions are, which is another barrier to entry that might be lowered by mentioning it in the FAQ.

> Thanks! Perhaps people like me (never used TOTP outside of my bank's security token; don't have a smart phone; no experience with password managers) are common enough to mention this in the FAQ?

Yes, I think so! I've forwarded this thread along to others working on PyPI as part of the OTF grant, and we'll be figuring out how best to explain using TOTP without being too mobile-centric.

I'm very sympathetic to not wanting to pay a service for the privilege of logging into your own account. 1Password is what came to mind because I happen to use it, but GNOME provides a TOTP client as well[1]. There are also a few others, based on a cursory search.

We also have support for WebAuthn in the pipeline, which will allow you to use a physical security key (or a physical authentication method like a fingerprint, if your device has support for that). That still does require a 1-time purchase for many users (the aforementioned security key), but the proliferation of built-in methods and cheap keys should help mitigate that somewhat.

[1]: https://gitlab.gnome.org/World/Authenticator

Reply on news.ycombinator.com