TOTP Authentication with Free Software

This is awesome. Especially for businesses that need to share a 2FA device between members for occasional uses. This is our case and the good old Iphone 7 we use for that is always battery empty when we need it !

Thank you for sharing, this will come in handy at my workplace.

What if something happens to the phone?

This is something that's really similar to what I want.

Ideally I would like a standalone device to display TOTP codes, but the only devices I've found only have a support for a single code.

I guess a feature phone with a custom app is the next best thing.

Fortunately you can undo these steps for $BANK1 and use your TOTP authenticator of choice: https://github.com/dlenski/python-vipaccess

e: I think you added a reference to this as I was writing my comment :)

I like minitotp[0] which only uses the Python standard library available from Python 3.4 and above.

[0] https://github.com/susam/mintotp

Yes, this is what pass-otp uses under the hood.

FreeOTP supports backups itself these days.

Backups can go to local or cloud storage.

Backups are encrypted with a passphrase that you enter when you set the app up, so the cloud storage providers can't grab your keys.

I use Microsoft Authenticator personally on iOS and Windows.

BitWarden is a good Open Spurce option, it’s cross platform but the TOPT stuff is available only with a paid plan.

The issue with TOTP here is it can only provide a 6-digit code, whereas an app can show for example "Do you want to authorise $6.21 at McDonalds?" before sending a transaction through. Grudgingly, I will accept that for most of the customer base this is probably the correct solution.

If there is a move in this area, I predict it will come from something like EU regulations on interoperability (we already have rules on Open Banking to some extent) - something to bear in mind next time the EU's approach to regulation is criticised as "anti-tech".

My bank (in NL) provides a separate device for authorization. It has a camera to scan a colour-coded QR code, then lets you see the total amount you're authorizing on its screen, and gives you a TOTP code to confirm the transaction.

Having a separate device may not be what you're looking for, but for me it beats installing a closed-source app on my phone.

Keepass2Android will do it too if you have the fields recorded from the desktop TOTP plugin.

I'm going off the assumption that you mean storing your password and TOTP secret in the same app.

Personally, I think storing your password and TOTP secret is worthwhile, but it ultimately depends on your threat model.

If your threat model is someone walking up to your unlocked desktop and unlocked password manager, then it's not very effective. That being said, I believe a determined enough attacker will always win -- just be more annoying to pwn than others and you will sift out the majority of attackers, imo.

But, if your threat model is that a website you use suffers a data breach and your username/password hashes are stolen, you have an extra line of defense with that second factor. This pretty much happens or will happen to everyone with online accounts at some point.

So my long-winded answer is that I do still consider it two factor auth, and I do think it's worthwhile -- but all effective security should be layered with extra defenses when possible.

EDIT: fixed some grammar, added some extra context.

Yes: to a first approximation, a second factor is something you are (or have), while a first factor is something you know. A second factor doesn't need to be unique, although uniqueness has separate benefits (especially when the unique factor is hard to clone or access physically).

TOTP isn't an ideal second factor, for most of the reasons above (combined with poor adherence to the standard, meaning that only the most basic subset of features tend to work). But is is still a second factor, unless you can do HMACs in your head :-)

I think yes.

While PCI DSS 4.0 says nothing specific about TOTP, it on page 171 also has this phrase about certificates:

"A digital certificate is a valid option for “something you have” if it is unique for a particular user".

So it is not an unreasonable analogy to claim that the TOTP seed stored in a desktop application is also "something that you have", as not having it prevents you e.g. from logging in from your friend's laptop.

Of course they can, and are, specially if you have two separate apps under two different passwords, one for the passwords vault, other for the TOTP.

What is the story with this tool. They seems to be popping up more recently but I haven't heard too much fanfare. How's the project funded and do people it?

I avoid them like a plague. They are in some of our B2B systems and it's using their proprietary push rather than TOTP. I don't know what Duo has done to fool these Saas/B2B providers into integrating with them.

Of course people who don't know better don't even understand the complaint and say "It's just an app on your phone".

I was going to add something on Duo before seeing that. If you have to use OTP with it, rather than FIDO, which I guess costs more, as my site doesn't support it, the hacks are fairly straightforward. On an Android phone, register a "tablet" (at least in the interface I see) using https://f-droid.org/en/packages/net.scintill.duotp/ and then use Aegis with the secret. (Why do people persist on suggesting Google Authenticator?) On a desktop, see https://github.com/simonseo/nyuad-spammer/tree/master/spamme... with an appropriate value of "start.nyu.edu". I use the secret with pass otp. Note that this is HOTP, not TOTP, so if you use the same secret on multiple devices, you need to synchronize the counter somehow, perhaps with a git hook under pass. (There are more baroque hacks to get the secret that I started with before finding those solutions.)

If you do want something like Duo for an organization, possibly self-hosted, and free-software-friendly, then https://www.privacyidea.org/ looks like a good option, but i have no experience with it.