News for hackers. Stuff that matters.
Re:Ask HN: Is Google phasing out Authenticator/TOTP? by tzs on Thursday February 24, 2022 @10:51AM (#30456085)
The simplest case, applicable if you have access to more than one device that supports generating TOTP codes at the time you are setting up TOTP for a given site, is to simply scan the site's QR code on all the devices.

E.g., when I create an account at a site that uses TOTP I scan the QR code on both my phone and my tablet.

(Actually, I scan it twice on each device, using two different TOTP apps. That way I'm covered if one of the apps stops being supported).

If you don't have all your devices available at the same time, or you want to allow for the possibility of adding a new device later, you can simply save the QR code. When the site gives you the QR code, take a screenshot and save that in some secure fashion. I save it as an encrypted PNG file.

To add a TOTP device later view the screenshot and scan the QR code.

Most sites that give you a TOTP QR code have an option to get the code in text. As an alternative to (or in addition to) saving a screenshot of the QR code you can ask for the text code and save that. Securing a text file might be more convenient for some people than securing an image file, although using the text code to set up a new phone or tablet likely won't be as convenient as using a QR code.

Re:Ask HN: Is Google phasing out Authenticator/TOTP? by jrochkind1 on Thursday February 24, 2022 @11:31AM (#30456663)
Interesting, thanks!

I guess you need to keep these QR codes/texts as carefully/securely as you would any password....

This is all a lot of work, trying to figure out how to adjust to this world of 2FA.

Re:Ask HN: Is Google phasing out Authenticator/TOTP? by tzs on Thursday February 24, 2022 @06:39PM (#30461879)
The good news is that the QR codes and/or texts should be easier to secure than passwords.

You need the password every time you login to a site, so you need to find a way to securely store passwords that also allows easy frequent access to the password.

You only need the QR code when setting up a TOTP application on one of your devices which generally will only be once per device and then once whenever you replace a device. You don't need frequent easy access and so can pick a storage method that is optimized toward ease of initial storage.

For example if I've just signed up for site example.com and I've saved a screenshot of the QR code in example.png, I'd do this:

  $ gpg -ear tzs@mydomain example.png
  $ mv example.png.asc ~/OneDrive/totp-recovery
  $ rm example.png
and then I no longer have to think about it or do anything with it unless I need to set up a new device, which is very rare.