News for hackers. Stuff that matters.

A comment on Requiring MFA on popular gem maintainers. Parent comment

Re:Requiring MFA on popular gem maintainers by ctrlmeta on Tuesday August 16, 2022 @09:52AM (#32482730)
Genuine question - Which keyfobs support scanning QR code presented by an online service to add the TOTP seed and then generate TOTP codes?

Any cross-platform recommendations for TOTP program that works on Windows, Linux, Mac?

[ Parent | on HN ]
Re:Requiring MFA on popular gem maintainers by rgoulter on Tuesday August 16, 2022 @10:00AM (#32482837)
QR code scanning is intended for mobile phone cameras as a way of communicating a TOTP secret.

When presented with a TOTP secret, every website I've seen has presented the option to show the TOTP secret as text, which can be copied across.

A password database like KeepassXC can store the TOTPs.

FIDO / U2F hardware like Yubikeys (or various alternatives) are also a convenient second factor.

[ Parent | on HN ]
Re:Requiring MFA on popular gem maintainers by striking on Tuesday August 16, 2022 @10:03AM (#32482868)
You type the seed in. Services almost unilaterally give you the option to get a seed code instead. Even if they don't, you can scan the QR code and get the seed out of it.
[ Parent | on HN ]