Hacker News Reader

Comment by ezekg | Hacker News Reader

If we're talking OTP/TOTP -- it's all the same. Even if a provider instructs you to use a specific app, e.g. Google or Authy, you can simply scan the QR code with whatever authenticator app you're using. All the QR code does is encode a URI containing the secret and issuer.

View on HN

Authy supports TOTP, but also has its own proprietary TOTP-esque format that a bunch of sites & companies use (Twitch and my bank, among them) that can't be copied into another site.

(Yes, it's bad, no, it shouldn't exist, no, I don't know why they don't just <...>, etc.)

Is it standardized?

I use keepassxc for twitch so it should be something fairly standard, I don't remember using special settings.

Anyway, I wanted to share this gist which might be of some help to migrate away from authy:

https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d...

Twitch supports regular TOTP now, thank goodness.

Authy (the app) does support generic TOTP which as you mentioned, so do hundreds of others. Unfortunately, the authy app (and some well meaning but not so well versed companies) opt to use Authy's proprietary OTP which isnt compatible with other clients.

This is simply not true. Just today an app asked me to use Microsoft Authenticator, and scanning the QR code with Google Auth and Authy didn’t work, earning me an “Invalid QR code” error and forcing me to install the app from MS.

I don't think there's a formal spec for the otpauth URI yet [0], even if there is a spec by Google [1], so this may just come down to MS adding some incompatibility to force usage of their authenticator, or the app using some proprietary authentication scheme that is not otpauth.

There's nothing complicated about otpauth provisioning URIs i.e. what's encoded into the QR code.

[0]: https://shkspr.mobi/blog/2022/05/why-is-there-no-formal-spec...

[1]: https://github.com/google/google-authenticator/wiki/Key-Uri-...

You assume that because you were not able to overcome whatever error/s you encountered with Google Auth and Authy, that you were being forced to use MS Authenticator.

Pretty uncharitable interpretation on your end. I am a developer and went to the extent of verifying the content of the QR code and the optional URL for manually adding it. No OTP code in there.

Try to be nicer next time.

I truly did not mean to come off as rude. The 'content of the QR code' would've revealed the actual seed and so would corroborate your assumption if you did, in fact, verify as much. I merey stated a troubleshooting fact. No offense intended.

My bad for misunderstanding the tone of your comment. I likely wouldn't have gone off in this direction if you asked me what measures I took to check the OTP code in a collaborative/constructive way rather than expressing doubt they way you did. Either way, all good.

I don’t think that’s what they’re saying. Authy supports TOTP but they also have a proprietary format.

That is also supported by Aegis.

And it seems to be totally generic, just 7 digits, and switching every 10 seconds instead of 30.

Bitwarden can import them too.

Reply on news.ycombinator.com