Ask HN: How many 2FA tokens do you have?
67 comments
Related: anyone have a good 2FA backup solution? Like if I loose my phone at this point I’d be pretty stuffed as my Google Auth app would be gone and my text 2FA also gone in the same moment.
TOTP is based off of a shared secret, so keeping that secret backed up is possible. I keep all of my TOTP tokens in a keepass database that is synced to my computers. If my keepass database is ever stolen and the encryption defeated then I'd be hosed, but I have a feeling there would be much worse problems in the world on that day.
Isn't the whole point of 2FA to keep you safe if your passwords get compromised? Seems like you may as well not bother with it.
I guess this means that any attacker will need to compromise your keepass database rather than just one of your other passwords, but it would help avoid a potential "hosed" scenario.
Maybe you think you're more likely to lose your phone then leak your master password? Perfectly reasonable I suppose :)
I guess this means that any attacker will need to compromise your keepass database rather than just one of your other passwords, but it would help avoid a potential "hosed" scenario.
Maybe you think you're more likely to lose your phone then leak your master password? Perfectly reasonable I suppose :)
Passwords are sending secrets around. TOTP auth doesn't involve sending any secrets because the algorithm shouldn't be practically reversible.
My master password has hundreds of bits of entropy and only leaves my brain to enter it.
Most likely bad scenario is master password gets lifted from a keylogger and the database is stolen. I don't see what keeping the secrets in an app does to help that though.
My master password has hundreds of bits of entropy and only leaves my brain to enter it.
Most likely bad scenario is master password gets lifted from a keylogger and the database is stolen. I don't see what keeping the secrets in an app does to help that though.
Sounds about correct, but this setup provides adequate protection against phishing and MITM attacks. The KeePass database itself can be hardened with a 2FA token.
When you set up Google Auth for a site, you can capture the seed value and back that up. 1Password has TOTP (Google Auth protocol) support baked in if you're looking for a way to use TOTP without relying on a single physical device.
I use strongbox[1] on iOS and it has a feature to print off your entire database (automatically formats everything). The passwords are stored in a standard kdbx file that you can sync manually or use drive, iCloud, etc. KeepassXC[2] has browser extensions and cross-platform apps and pairs well with strongbox. (No print feature afaik) Both apps are open-source.
[1] https://strongboxsafe.com/ [2] https://keepassxc.org//
[1] https://strongboxsafe.com/ [2] https://keepassxc.org//
You usually have backup codes, you can print them, send them to yourself in your emails, have them in a passport manager, as notes, etc.
Sure, that’s a massive pain in the butt though. I’m thinking about something that allows me to get back up and running with the same system relatively quickly.
This. I am pretty scared of losing my phone too.
Reinstalling the app didn't seem to revive the tokens, last time I tried.
Reinstalling the app didn't seem to revive the tokens, last time I tried.
Yeh, 2FA through an authenticator app feels so fragile for the consequences of something going wrong.
And as far as I know you can only have one device enabled with Google Authenticator at a time?
If it could be on multiple devices then I could set up an old phone and have it as a backup.
Edit: I’m wrong. You can sync two Authenticator apps using the same QR code during setup.
If it could be on multiple devices then I could set up an old phone and have it as a backup.
Edit: I’m wrong. You can sync two Authenticator apps using the same QR code during setup.
You can export Google Auth tokens and reimport them on a separate device.
Authy seems to sync between the 2 devices I have with it installed (which indicates that it's stored "in the cloud").
I always have second device mirroring the important stuff on my primary device. Usually my most recently replaced phone.
Authy seems to sync between the 2 devices I have with it installed (which indicates that it's stored "in the cloud").
I always have second device mirroring the important stuff on my primary device. Usually my most recently replaced phone.
As I was typing the question I thought “I guess my old phone could do the job?” I’m wondering there is a middle ground option.
There is the OTP extension[1] for Password Store[2], although it kind of defeats the point of 2FA to have OTP tokens stored alongside passwords. Might be best used as a backup?
[1] https://github.com/tadfisher/pass-otp
[2] https://www.passwordstore.org
[1] https://github.com/tadfisher/pass-otp
[2] https://www.passwordstore.org
I wouldn't trust closed source services for something this simple. Authy wants your phone number and Google wants anything it can get its hands on. There are plenty of open source options with backup options.
Use Bitwarden. You can back up everything into an encrypted JSON file - including your 2FA TOTP stuff. Import it into a self-hosted Bitwarden too, if you like.
EDIT: Exactly as petepete said. Multiple FIDO tokens like Yubikeys are supported.
EDIT: Exactly as petepete said. Multiple FIDO tokens like Yubikeys are supported.
I use BitWarden for 2FA via their paid plan (£10 per year).
My BitWarden account is secured by Yubikey, of which I have two.
My BitWarden account is secured by Yubikey, of which I have two.
Ok, think I need to look at Yubikey as it keeps coming up here. I have a paid LastPass account, maybe there is something in there I can use.
Yeah, you can lock your LastPass with it in the same way I do mine.
Knowing my passwords and 2FA are protected and backed up is a huge relief.
Knowing my passwords and 2FA are protected and backed up is a huge relief.
LastPass authenticator uses centralized (encrypted) storage of keys
iCloud Keychain works across devices, backed up automatically to iCloud. Only for Apple devices but works great.
I've used lastpass, Keepass, 1password (which can store TOTP codes) but I've moved entirely to a Mooltipass. Easy to backup, less fuss all around. (It does TOTP). Open hardware.
https://www.mymooltipass.com/
https://www.mymooltipass.com/
Did you backup the 'seed' QR-CODE somewhere safe? If you lose access to Google Authenticator, you lose the ability to use OTP for access.
4 for work
10 personal
They are getting a bit hard to handle mostly because my app (authy) doesn't have a good enough set of icons
They are getting a bit hard to handle mostly because my app (authy) doesn't have a good enough set of icons
Only a single Yubikey. After the purchase, I expected lots of service to implement
WebAuthn, but none that I use bothered to, except for select few. I touch it once a year at best.
12.
I have three Yubikeys that I use for TOTP and that house my GPG keys and SSH key. At any given time, I have one on my person, one in my home office and one off-site. I only use TOTP on the Yubikeys for "critical accounts" and use oathtool and password-store to perform TOTP for most accounts (in Firefox via passff).
Password-store features git push and pull so I keep my encrypted passwords and TOTP keys on a couple remote Git servers. Because I use passwords that I don't know for every service, the Yubikeys are really more about being a safe way to back-up and transport my encryption key. If I've got that, I can always decrypt my passwords.
Password-store features git push and pull so I keep my encrypted passwords and TOTP keys on a couple remote Git servers. Because I use passwords that I don't know for every service, the Yubikeys are really more about being a safe way to back-up and transport my encryption key. If I've got that, I can always decrypt my passwords.
How do you sync the Yubikeys if they're in different locations?
Like, if you're at work and sign up to a new service - how do the other two get associated?
Sorry if that's an obvious question.
Like, if you're at work and sign up to a new service - how do the other two get associated?
Sorry if that's an obvious question.
I do rotate which key is off-site. For the "critical sites" this means I've only got two keys registered for some period of time. I don't use the TOTP on the Yubikeys for most sites so signing up for a new service involves generating a new TOTP key with oathtool and saving that in password-store (along with the URL and login name) when I generate the password.
This sounds like a neat arrangement. How do you go about this when you’re on the go? - do you have an app on your phone which support unlocking your password-store using a smart card, or do you just not manage passwords/MFA except on your computer?
Each of my phones has its own private key and can decrypt the stored passwords. Having a private key protected only by a six number passcode is obviously a weak point in my security. Since password-store is encrypting each password with seven or eight public keys, it's relatively easy to revoke a compromised key and to re-encrypt all passwords/TOTP keys (excluding the compromised key).
I mostly generate passwords and add entries to my password manager from a computer but I've got all the required public keys on each device so it's theoretically possible to manipulate the password-store from a phone or tablet as well.
I mostly generate passwords and add entries to my password manager from a computer but I've got all the required public keys on each device so it's theoretically possible to manipulate the password-store from a phone or tablet as well.
27
Unrelated but no joke I have something like 600-700 accounts stored in LastPass
Unrelated but no joke I have something like 600-700 accounts stored in LastPass
4 in Google Authenticator and 21 in Authy, 1 of which may have been superseded.
One service I use has four separate 2FA tokens to use with different service functions, and I have one account for me and one for my wife, so that single service accounts for 8 of 21 Authy tokens.
One service I use has four separate 2FA tokens to use with different service functions, and I have one account for me and one for my wife, so that single service accounts for 8 of 21 Authy tokens.
29 in an app. I use Keepass heavily for password storage.
Two Yubikeys (you always want to have two) and 28 TOTP tokens. I wish more services would support Webauthn.
35 in my main 2FA app (Tofu), and 4 Yubikeys configured as U2F in 6-8ish accounts. I also have a few TOTPs in one of the Yubikeys (which has a limit of 32).
I have none. I use keepassxc to manage all my accounts.
I try to avoid 2FA. I have other strategies around account compromise.
I try to avoid 2FA. I have other strategies around account compromise.
Relevant blog post: https://www.go350.com/posts/now-they-have-2fa-problems/
There is only one real answer to this: too many.
Why can’t websites show a QR code that my TOTP app recognizes and validates?
You're going to need to explain a little more of your idea. What does this QR code do? What happens if I put the Google.com QR code on my web site? What does your TOTP app do with this QR code when it sees one? Stuff like that.
61 2FA tokens!
More via phone number 2FA as well!
And a lot of passwords saved.... my app doesn't give me a count. Probably need to look on desktop :-)
More via phone number 2FA as well!
And a lot of passwords saved.... my app doesn't give me a count. Probably need to look on desktop :-)
11
I manage them with this:
https://github.com/pcarrier/gauth
I manage them with this:
https://github.com/pcarrier/gauth
45 or so. But - they're all in 1Password, so the management is done for me. I don't have to scroll to a particular entry, it autofills everywhere I have to use them.
I also have a handful of yubikeys for more secure things.
I also have a handful of yubikeys for more secure things.
That's not 2FA anymore though, if you regular password is also stored there.
71 in total. I store all tokens in Aegis and have automatic backups configured, so I don't find it to be too unmanageable. It's seem like a lot, but then again I also have hundreds accounts in my password manager at this point.
Wide Web Authn[1] adoption can't come soon enough! This is so stupid! All I need is a single private key to login to all the websites!
I personally like to keep it in my iCloud account because I don't trust myself with keeping a private key for too long.
[1] https://webauthn.io
I personally like to keep it in my iCloud account because I don't trust myself with keeping a private key for too long.
[1] https://webauthn.io
OTP is much simpler, I still don't know how I will be able to implement Webauthn for rubygems on the command line
What is "rubygems on the command line" ?
From the replies it sounds like this is talking about client software? An unattended client should not be able to do WebAuthn as the whole point is that a human is present and authorising the authentication step - this is part of its defence against remote attackers, if I have 100% full of Bob's device I still can't touch the sensor or button to authenticate as Bob.
However, if you mean the human is present and running command line apps, that's fine, definitely possible. The authenticator is typically a USB device, it speaks HID (like a USB keyboard or mouse) but a specific custom HID protocol for this purpose, you can get a library to help talk to it, and that's how OpenSSH works with Yubikeys.
Now, OpenSSH is specifically telling the authenticator "I'm SSH, not the Web" but for "Rubygems on the command line" you could choose either to say "I'm a web browser" or, you could say "I'm this custom rubygems on the command line thing" and that gets you public key signed messages that are unique to your thing, verifiable by a remote system as not "WebAuthn" but "Custom rubygem thing".
Apple and Google (for the Android ecosystem) actually do all this today for phones, if you use a Web browser you get WebAuthn, but from a normal phone app you can do the exact same Usernameless/ Passwordless login like WebAuthn, but using a custom per-app message that can't be impersonated by other apps on the same phone.
From the replies it sounds like this is talking about client software? An unattended client should not be able to do WebAuthn as the whole point is that a human is present and authorising the authentication step - this is part of its defence against remote attackers, if I have 100% full of Bob's device I still can't touch the sensor or button to authenticate as Bob.
However, if you mean the human is present and running command line apps, that's fine, definitely possible. The authenticator is typically a USB device, it speaks HID (like a USB keyboard or mouse) but a specific custom HID protocol for this purpose, you can get a library to help talk to it, and that's how OpenSSH works with Yubikeys.
Now, OpenSSH is specifically telling the authenticator "I'm SSH, not the Web" but for "Rubygems on the command line" you could choose either to say "I'm a web browser" or, you could say "I'm this custom rubygems on the command line thing" and that gets you public key signed messages that are unique to your thing, verifiable by a remote system as not "WebAuthn" but "Custom rubygem thing".
Apple and Google (for the Android ecosystem) actually do all this today for phones, if you use a Web browser you get WebAuthn, but from a normal phone app you can do the exact same Usernameless/ Passwordless login like WebAuthn, but using a custom per-app message that can't be impersonated by other apps on the same phone.
See https://github.com/rubygems/rubygems.org/pull/2865 for the web part
> From the replies it sounds like this is talking about client software?
Yes the command line is a client to the rubygems server
> An unattended client should not be able to do WebAuthn as the whole point is that a human is present and authorising the authentication step
You either need a PIN, a fingerprint, a press, or no action just owning the device or the software.
> if I have 100% full of Bob's device I still can't touch the sensor or button to authenticate as Bob.
If you have a perfect copy of a Yubikey or the same fingerprint you should be able to authenticate I think
> OpenSSH works with Yubikeys
Nice, I will look into it
> From the replies it sounds like this is talking about client software?
Yes the command line is a client to the rubygems server
> An unattended client should not be able to do WebAuthn as the whole point is that a human is present and authorising the authentication step
You either need a PIN, a fingerprint, a press, or no action just owning the device or the software.
> if I have 100% full of Bob's device I still can't touch the sensor or button to authenticate as Bob.
If you have a perfect copy of a Yubikey or the same fingerprint you should be able to authenticate I think
> OpenSSH works with Yubikeys
Nice, I will look into it
> You either need a PIN, a fingerprint, a press, or no action just owning the device or the software.
The latter option shouldn't work for WebAuthn. The authenticator signs a message, saying basically "I promise I'm still me, whoever that is" and although it is nowhere near smart enough to understand the whole message (your browser wrote big parts of the message and it's just signing) it does understand a handful of bitflags it is signing. One of those flags is named UP (User Present) and the hardware should refuse to sign this flag unless it has seen some sign (like a touch sensor) that a human is present. UP is mandatory in WebAuthn, the remote server will (should) check it, and even though it's a single bit it was signed, so you can't change it.
However even if you don't want to actually do WebAuthn, most Security Keys always do UP, there is no way to tell them "Don't check your sensor", it's just mandatory. I think this is even true with the relatively expensive Yubico devices (but I only own some cheaper ones)
The next flag, UV, you can avoid, that's User Verified, which means a PIN, or a fignerprint sensor or something that demonstrates it wasn't just any old human it was apparently our owner, you don't need to require that and cheaper devices generally can't do it anyway.
> If you have a perfect copy of a Yubikey
There's no reason to be able to copy them. They're not intended to be able to be copied. You'll notice (if you have one) that there is only a "reset to factory" type feature, which randomises the guts. So, probably Yubico can't do it. Now, maybe if you've got a micro-electronics lab, the sort of place that reverse engineers modern chips to figure out how Intel or Apple or whoever did it, you could take a Yubikey to pieces, get the data out, and then make two clones that way, but first you need to steal the real one, for some period of time, and then put back one of the duplicates. Makes a good Hollywood plot, not sure it's realistic.
> or the same fingerprint you should be able to authenticate I think
You can't send the fingerprint over the network, the device looks at it locally, and only checks "Yup, that's the one I expected" before signing UV. So you need to send the actual finger. Now, maybe your attacker has a drone carrying a severed finger or something but we're getting pretty far away from teenager hacking thousands of accounts from their bedroom here.
The latter option shouldn't work for WebAuthn. The authenticator signs a message, saying basically "I promise I'm still me, whoever that is" and although it is nowhere near smart enough to understand the whole message (your browser wrote big parts of the message and it's just signing) it does understand a handful of bitflags it is signing. One of those flags is named UP (User Present) and the hardware should refuse to sign this flag unless it has seen some sign (like a touch sensor) that a human is present. UP is mandatory in WebAuthn, the remote server will (should) check it, and even though it's a single bit it was signed, so you can't change it.
However even if you don't want to actually do WebAuthn, most Security Keys always do UP, there is no way to tell them "Don't check your sensor", it's just mandatory. I think this is even true with the relatively expensive Yubico devices (but I only own some cheaper ones)
The next flag, UV, you can avoid, that's User Verified, which means a PIN, or a fignerprint sensor or something that demonstrates it wasn't just any old human it was apparently our owner, you don't need to require that and cheaper devices generally can't do it anyway.
> If you have a perfect copy of a Yubikey
There's no reason to be able to copy them. They're not intended to be able to be copied. You'll notice (if you have one) that there is only a "reset to factory" type feature, which randomises the guts. So, probably Yubico can't do it. Now, maybe if you've got a micro-electronics lab, the sort of place that reverse engineers modern chips to figure out how Intel or Apple or whoever did it, you could take a Yubikey to pieces, get the data out, and then make two clones that way, but first you need to steal the real one, for some period of time, and then put back one of the duplicates. Makes a good Hollywood plot, not sure it's realistic.
> or the same fingerprint you should be able to authenticate I think
You can't send the fingerprint over the network, the device looks at it locally, and only checks "Yup, that's the one I expected" before signing UV. So you need to send the actual finger. Now, maybe your attacker has a drone carrying a severed finger or something but we're getting pretty far away from teenager hacking thousands of accounts from their bedroom here.
for command line stuff you should be using public key actually
Webauthn works with public keys, but how can I get the public key of the Touch ID sensor and actually I would need the private key to sign the challenge
I have 76 (mix of perso and work accounts ~50/50)
12
Mostly cloud services, version control, email.
Mostly cloud services, version control, email.
None. I think - I don't know what they are exactly.
I have 24 keys in andOTP. I have the backed up with password-store and the OTP plugin. I also have my most frequently used ones on profiles in my hardware OnlyKey which can support FIDO2, TOTP, Yubikey's special format, text passwords and more. I have 2 of these keys, the other in a fire safe. I'm not really concerned with losing a single device because of redundancy.
The things I hate about the 2FA process:
1) requiring a phone number, especially only having SMS for 2FA like my foreign bank (I've reported the issue with SIM swapping with them on support and in person, but considering their system still isn't UTF using a very old encoding so I can't even type a comma in a message without errors, I'm not holding my breath)
2) not offering WebAuthn, especially as a big firm
3) Supporting specifically Yubikey and not FIDO2/WebAuthn
4) using some bullshit closed-source wrapper around TOTP like Symantec VIP that doesn't have a Linux client and requires me to use some random Python script to get spoof a Mac system to get a code (thanks Schwab)
The things I hate about the 2FA process:
1) requiring a phone number, especially only having SMS for 2FA like my foreign bank (I've reported the issue with SIM swapping with them on support and in person, but considering their system still isn't UTF using a very old encoding so I can't even type a comma in a message without errors, I'm not holding my breath)
2) not offering WebAuthn, especially as a big firm
3) Supporting specifically Yubikey and not FIDO2/WebAuthn
4) using some bullshit closed-source wrapper around TOTP like Symantec VIP that doesn't have a Linux client and requires me to use some random Python script to get spoof a Mac system to get a code (thanks Schwab)
Is this the Symantec script you're referring to? https://github.com/dlenski/python-vipaccess
Once you follow those steps you can generate codes from any TOTP system (Yubi, Android, etc).
Yes, but it says that it's brittle because it needs to spoof a specific Mac UA and this is not the most user-friendly process—especially for a newbie that switched to Linux and isn't used to the terminal and Python, but wants account security. I emailed support to just use TOTP because this step is dumb.
If Symantic wants to see TOTP as a service that's fine, I guess, but I just picture an astronaut with a gun saying it was just TOTP the whole time. Meanwhile they try to sell hardware keys around the obscurity layer of their product.
If Symantic wants to see TOTP as a service that's fine, I guess, but I just picture an astronaut with a gun saying it was just TOTP the whole time. Meanwhile they try to sell hardware keys around the obscurity layer of their product.
None.
Well, two, technically, but I'd lost them long ago.
Well, two, technically, but I'd lost them long ago.
That feels like a lot, and is starting to get unmanageable.
I also have a handful of services tied to a Yubikey. But I've no way of knowing how many.
So, how many do you have?