News for hackers. Stuff that matters.

A comment on Requiring MFA on popular gem maintainers. Parent comment

Re:Requiring MFA on popular gem maintainers by striking on Tuesday August 16, 2022 @09:48AM (#32482673)
Your second factor could be whatever you want it to be. Phone app, keyfob, TOTP program running on your machine. Many services allow for multiple options.

Most 2FA apps have a convenient "move all of my codes to another device" function, offer online sync, whatever.

And even if they didn't, every service provides recovery codes that you could use in case of an emergency, should you need access to some service and all else fails.

[ Parent | on HN ]
Re:Requiring MFA on popular gem maintainers by ctrlmeta on Tuesday August 16, 2022 @09:52AM (#32482730)
Genuine question - Which keyfobs support scanning QR code presented by an online service to add the TOTP seed and then generate TOTP codes?

Any cross-platform recommendations for TOTP program that works on Windows, Linux, Mac?

[ Parent | on HN ]
Re:Requiring MFA on popular gem maintainers by rgoulter on Tuesday August 16, 2022 @10:00AM (#32482837)
QR code scanning is intended for mobile phone cameras as a way of communicating a TOTP secret.

When presented with a TOTP secret, every website I've seen has presented the option to show the TOTP secret as text, which can be copied across.

A password database like KeepassXC can store the TOTPs.

FIDO / U2F hardware like Yubikeys (or various alternatives) are also a convenient second factor.

[ Parent | on HN ]
Re:Requiring MFA on popular gem maintainers by striking on Tuesday August 16, 2022 @10:03AM (#32482868)
You type the seed in. Services almost unilaterally give you the option to get a seed code instead. Even if they don't, you can scan the QR code and get the seed out of it.
[ Parent | on HN ]