News for hackers. Stuff that matters.

A comment on Show HN: Generate shared 2FA codes for your entire team. Parent comment

Re:Show HN: Generate shared 2FA codes for your entire team by jamesvnz on Sunday September 26, 2021 @06:15PM (#28665159)
It looks like with this service the user who can generate a TOTP can't see the backing seed. Therefore, if they leave, and get removed from Slack, they can't generate a code. If you just shared the seed then everytime someone left the team you'd need to regenerate.
[ Parent | on HN ]
Re:Show HN: Generate shared 2FA codes for your entire team by fragmede on Sunday September 26, 2021 @06:53PM (#28665400)
"need to" is a bit much. One should absolutely regenerate keys but to every attackers delight (and every CISO's chagrin), that doesn't make it actually happen. For things that need to be secure, (forced) expiration of keys is an important part of the system as a whole.
[ Parent | on HN ]
Re:Show HN: Generate shared 2FA codes for your entire team by cmeacham98 on Sunday September 26, 2021 @07:50PM (#28665691)
Is it possible to reconstruct the seed (or some equivalent that would allow you to generate future codes)? If yes, how many codes would you need to do so?
[ Parent | on HN ]