News for hackers. Stuff that matters.

A comment on Ask HN: Why did smartphones become a single point of failure?. Parent comment

Re:Ask HN: Why did smartphones become a single point of fail... by cube00 on Tuesday August 09, 2022 @09:34AM (#32397626)
It's interesting that a super key even exists. Normally the enrolment QR codes are one time use only.
[ Parent | on HN ]
Re:Ask HN: Why did smartphones become a single point of fail... by gunapologist99 on Tuesday August 09, 2022 @05:44PM (#32404747)
This is incorrect.

A standard TOTP QR code can be used on multiple devices or saved and printed (and stored in a safe or something). There is no expiration date encoded in the QR; it is simply the shared secret for the TOTP app to use and some extra metadata like labels. See https://www.rfc-editor.org/rfc/rfc6238

It is a good idea to enroll multiple devices as a backup against failure, or to store it somewhere safe.

[ Parent | on HN ]