Hacker News Reader

Comment by mnky9800n | Hacker News Reader

I've always wanted to make a two-factor authentication device that has a camera, QR reader, and an e-ink screen for listing the codes that otherwise does nothing else. but ive always been a bit limited because I don't really know where to get started making hardware. but i feel like 2-factor authentication is the number one thing preventing me from getting rid of my smartphone which is kind of silly because why do i need some massive super computer in my pocket (at least from the perspective of the 1980s) to have an alternating cypher to login to websites on my laptop.

View on HN

Years ago I had a little token that printed auth codes. They were everywhere. I had it on my keychain. I recall thinking it was nifty.

I still have one for getting into my bank

My Sensor Watch does this, I think it's one of its coolest features.

Well, to get started you could buy one of these:

https://www.reiner-sct.com/en/produkt/reiner-sct-authenticat...

… and then decide whether you really want to get into electronics development.

The easiest, fastest way to hack this together would be a raspberry pi zero with a display hat. It'd be chunky, but it would keep all the TOTP shared secrets off of other less reliable devices.

Airplane mode on a phone is pretty feasible and probably has more upsides than downsides.

Could probably compile it in if discipline is a concern.

(As I posted already in the comments here) put your phone in a "Faraday bag" and pull it out when you are expecting a 2FA authentication request.

That's precisely why I was interested in the Precursor: https://www.crowdsupply.com/sutajio-kosagi/precursor

I'll eventually pick one up to play around with..

Some password managers like 1Password can do the two-factor stuff for you, so you don't have to pull out your phone. On the fully supported pages it'll just autofill your username, main password, and one-time password.

Just as a reminder. If you save the 2FA token in the same password database as the actual password of the website you effectively neutralized 2FA or at the very least weakened it.

If you store your password in a password manager, is it accurate to still frame it as 'something you know'? Or is it just another 'something you have'?

Downside is such device is going to be obsolete soon with passkeys getting traction.

Reply on news.ycombinator.com