News for hackers. Stuff that matters.

A comment on Ask HN: Why did smartphones become a single point of failure?. Parent comment

Re:Ask HN: Why did smartphones become a single point of fail... by Double_a_92 on Tuesday August 09, 2022 @09:30AM (#32397568)
> you need to call them up to reset this

My bank sent me a super key (some colorful QR code) to setup new 2FA devices, which I need to securely store somewhere.

[ Parent | on HN ]
Re:Ask HN: Why did smartphones become a single point of fail... by cube00 on Tuesday August 09, 2022 @09:34AM (#32397626)
It's interesting that a super key even exists. Normally the enrolment QR codes are one time use only.
[ Parent | on HN ]
Re:Ask HN: Why did smartphones become a single point of fail... by gunapologist99 on Tuesday August 09, 2022 @05:44PM (#32404747)
This is incorrect.

A standard TOTP QR code can be used on multiple devices or saved and printed (and stored in a safe or something). There is no expiration date encoded in the QR; it is simply the shared secret for the TOTP app to use and some extra metadata like labels. See https://www.rfc-editor.org/rfc/rfc6238

It is a good idea to enroll multiple devices as a backup against failure, or to store it somewhere safe.

[ Parent | on HN ]