Comment by whartung | Hacker News Reader

Comment by whartung | Hacker News Reader

Parent Full thread

Github 2FA is made extra fun because they only offer a single mechanic of replacing it (that I know of), and that's using the recovery codes.

So, they forced me to use 2FA, and I dutifully printed out the recovery codes (don't write down your passwords, that's bad practice, but here's 20 recovery codes that stand between you and losing your account forever, so you know, manage that somehow).

When I bought a new iPhone, apparently none of my stored information got copied over. The apps did, but none of the information for those apps (for example, the TOTP info maintained by the authenticator I used). So, I went to log in to Github, opened up my authenticator app, and it was blank.

Thankfully I had the codes...back at home, in a drawer, guarded by a cat, so I wasn't completely doomed, but it ruined the day to be sure until I could get home and recover it and recalibrate my TOTP app.

Oh, guess who has a photo of their recovery codes on their phone now?

TOTP backups from phones is a major issue, from what I can tell you simply can't do it.

With a yubikey everything is stored on the key and the phone is just a terminal, so it travels between phones. Now if you lose the key that's another issue :)

Sure, so same problem. Less likely your yubikey will be stolen I guess, but less convenient too (something else to carry)

But it's a key though. It goes on the keychain. Unless you don't carry around keys either, in which case yes, that would be very inconvenient indeed.

Also, your Yubikey is probably less likely to be stolen or break, but I figure it's much easier to lose it, which is why you might want to have two, just in case. And that's where it gets really inconvenient.

>But it's a key though. It goes on the keychain. Unless you don't carry around keys either, in which case yes, that would be very inconvenient indeed.

Half the time I choose for TOTP authentication over Yubikey because "Oh god it's in the living room I don't want to go get it."

I do have a backup key mind, but that's USB-C instead of A. Maybe I should make another USB A backup.

Two yubikeys sounds ok, but I don't 100% trust that the second one works forever. Anyway, my keychain got ran over by a bus, and luckily the yubikey survived.

The problem I've always had with the two yubikey-model (except for cost an inconvenience of course) is that you can't really keep the second key in cold storage, because you need to enroll it to new accounts. That doesn't happen every day, but probably regularly enough that you can't keep in a bank vault or something.

On the other hand, you know the second one works and haven't spontaneously bitrotted.

My nerdy preferred version would have been (pre-passkey) to have a hardware token where the root secret is generated out-of-device and exist on e.g a paper backup or something. Then I could just buy a new hardware token and inject the same token if the device dies.

You can technically do this with TOTP if you save the secret instead of simply enrolling the account. You're not supposed to do that, though.

> But it's a key though. It goes on the keychain. Unless you don't carry around keys either, in which case yes, that would be very inconvenient indeed.

Even if I do have keys, they are safe in my pocket, not sticking out the side of a fragile USB port.

There's then the whole mobile problem -- yubikeys are perhaps fine with my laptop, but how about when I'm using a mobile and my laptop is in my bag, or at home?

And OK, lets say I solve all that. How do I add a second key?

The beauty of SMS for 2FA is that my phone number sticks with me. If my phone is lost or stolen, a new sim card is sent to my home and I have access to all my 2FA authenticaitons. It also ties in well with my phone -- if I get an SMS with a number 123456, it appears as an automatic insert option on the form, no need to go to another app to copy a number and switch back to paste.

TOTP and Yubikeys do not match the usability of SMS.

  Even if I do have keys, they are safe in my pocket, not sticking out the side of a fragile USB port.

It's difficult, though not impossible, to break your USB port with a Yubikey due to its shape. It's not a regular USB plug and will come out quite easily.

  but how about when I'm using a mobile and my laptop is in my bag, or at home?

USB-C and NFC variants are quite common.

  And OK, lets say I solve all that. How do I add a second key?

The same way you add the first--most of the time, you have to scan a QR code. You can scan it more than once.

  The beauty of SMS for 2FA is that my phone number sticks with me. If my phone is lost or stolen, a new sim card is sent to my home and I have access to all my 2FA authenticaitons.

I'm not giving you my phone number, and mobile providers are known to send replacement SIM cards to random strangers if they ask nicely.

2FAS [0] and I think Authy [1] as well have options for backing up your TOTP config

0: https://apps.apple.com/us/app/2fa-authenticator-2fas/id12177...

1: https://apps.apple.com/us/app/twilio-authy/id494168017

It's the Google Authenticator app's fault. The most popular TOTP app probably, and for a long time, they were saying it's intentionally designed not to let you copy the codes. Now you can, but there are lots of pitfalls and vague documentation. I'm not convinced that TOTP is a user-friendly design to begin with, but it didn't have to be this bad.

I don't fw TOTP now. There are other apps, but I'm done. I'll only use it if the iPhone Keychain has built-in support some day.

The iOS Keychain already supports TOTP.

Ah yeah, it's hidden away a little cause they don't call it TOTP and you need to manually copy codes into your settings app. Gonna see if I can set it up on Mac cause that's where I'll actually maybe need it.

Set up should be simpler than needing to manually copy codes into your settings app.

When a QR code is present on screen that resolves to a TOTP seed, an additional context menu option should be present to "Add Verification Code in Passwords" or "Set Up Verification Code" or similar.

Here's a screenshot I nabbed from a way-too-wordy article on the subject: https://tidbits.com/uploads/2021/10/Add-Verification-Code-15...

Use ravio on io’s, lets you copy, backup and duplicate them to other places.

That's why I store them in Bitwarden.

Oh huh, I switched from AndOTP to Aegis and was able to export from the former and import into the latter. Then on desktop I'm using Authenticator [0], which can import from both.

[0] https://flathub.org/apps/com.belmoussaoui.Authenticator

>TOTP backups from phones is a major issue, from what I can tell you simply can't do it.

I've done it in Aegis multiple times. They even allow you to export the 'database' (which iirc is just an encrypted json file)

What I do is when I receive a QR code to set up TOTP while creating a new account is to take a screenshot of that code and save an encrypted copy of that screenshot. Then it is just part of my ordinary data backed up as part of my normal backups.

If I ever want to set up a TOTP app on a new device it is not hard to decrypt all my saved QR codes, open them all at the same time in Preview on my Mac, select the option to show one page at a time, and then get into a nice rhythm using one hand to scan on the new device and the other to hit "page down" on the Mac keyboard.

If the site also gives a text form of the shared secret from the QR code I save that too. Having the text form around is handy in case I need to login but for some reason don't have the devices where I have the TOTP apps. Given the text form of the code, this command, from the oathtool package, will give the current login code:

  $ oathtool --totp -b "secret"

That's if the secret is encoded in base32, which they commonly are. If it is in hex leave off the -b.

If the site doesn't give a text form of the shared secret I read the QR code to get it. If you do that be careful. Some QR code reader apps do the processing server side which you probably don't want...and they don't necessarily make that clear in the description. I had to try a couple of apps from the Mac app store before finding one that did it client side. (Then I found out that Mathematica's BarcodeRecognize function can do it, and deleted the QR code reader app. Now I just open Mathematica, type BarcodeRecognize[], drag and drop an image file that has the QR code between the brackets, and hit shift-return).

Why use a QR code reader app instead of the built in camera app?

Personally, I email the backup codes to myself. Yes it's less secure in theory, but the only time I'm using totp is against my will.

> Why use a QR code reader app instead of the built in camera app?

The QR code is on the screen of my desktop Mac. The camera is right above the screen facing me and can't see what is on the screen.

I could read it with the built in camera app on my iPhone or iPad, but that just tells me it is a QR code for the TOTP authenticator app I use and opens that if I tap. I don't see a way to get it to tell me the content of the QR code in text form. Even if it had a way that would be on the phone and I want the text to save it on the Mac.

Oh, got it. Classic problem with QR codes. Some people get around it with two mirrors, haha.

Use Aegis.

there are other methods for 2fa recovery. The main one involves an SSH key you've previously added to your account.

Using said ssh key as one of the 2fa choices for standard login would be quite a nice feature too...

Reply on news.ycombinator.com