News for hackers. Stuff that matters.

A comment on OnlyKey: Open-Source Alternative to YubiKey. Parent comment

Re:OnlyKey: Open-Source Alternative to YubiKey by cal5k on Thursday December 26, 2019 @02:48PM (#21886186)
A lot of services, like GSuite and LastPass, allow you to register multiple hardware keys. The best bet is to register several of them with these sites, then put one or two offsite (e.g. in a safety deposit box) just in case.

Then, use GSuite to sign into other services (like Slack) wherever supported to minimize how often you need to do this.

[ Parent | on HN ]
Re:OnlyKey: Open-Source Alternative to YubiKey by idlewords on Thursday December 26, 2019 @03:30PM (#21886473)
Use TOTP (like Google Authenticator) as a backup method as well. It's helpful for scenarios like having to log in on a phone.
[ Parent | on HN ]
Re:OnlyKey: Open-Source Alternative to YubiKey by 91iejrj20310 on Thursday December 26, 2019 @03:34PM (#21886522)
Is Google Authenticator tied to your smartphone, to your account, or a combination of both? Can you transfer it to another smartphone? Is it being backupped automatically?

We're amongst a very technologically educated part of the population here, and honestly, I'm not sure about the scope of Google Authenticator. Quite sure that many aren't.

[ Parent | on HN ]
Re:OnlyKey: Open-Source Alternative to YubiKey by dbrgn on Friday December 27, 2019 @04:40AM (#21890242)
Google Authenticator implements TOTP, which is actually a very simple standard: https://pthree.org/2014/04/15/time-based-one-time-passwords-...

If you can extract the private key, you can transfer it to another phone or device.

On Android, AndOTP is open source (available on F-Droid) and allows encrypted backups. As for Google Authenticator, I don't think you can create backups.

[ Parent | on HN ]
Re:OnlyKey: Open-Source Alternative to YubiKey by spockz on Thursday December 26, 2019 @04:06PM (#21886774)
With Authy, a Google Authenticator, on iOS the codes are backed up in iCloud and protected with a pass code. I’m not sure whether the pass code is used to actually encrypt things or just as a soft lock.
[ Parent | on HN ]
Re:OnlyKey: Open-Source Alternative to YubiKey by cr7pt0 on Friday December 27, 2019 @12:00AM (#21889331)
FYI OnlyKey already supports TOTP for up to 24 accounts. No apps required OnlyKey types the 6 digit code for you.
[ Parent | on HN ]
Re:OnlyKey: Open-Source Alternative to YubiKey by idlewords on Friday December 27, 2019 @05:55AM (#21890557)
You need it for when you lose the key.
[ Parent | on HN ]
Re:OnlyKey: Open-Source Alternative to YubiKey by allset_ on Friday December 27, 2019 @03:10AM (#21889908)
How does it know which OTP to type?
[ Parent | on HN ]
Re:OnlyKey: Open-Source Alternative to YubiKey by cr7pt0 on Friday December 27, 2019 @08:44AM (#21891268)
You load the login data to your key using the app, press a button on your OnlyKey and it types any or all of the following: -URL to login page -Username -Password -TOTP

To watch setup videos see https://onlykey.io/watch

[ Parent | on HN ]