News for hackers. Stuff that matters.

A comment on Tell HN: It is impossible to disable Google 2FA using backup codes. Parent comment

Re:Tell HN: It is impossible to disable Google 2FA using bac... by j1elo on Thursday January 19, 2023 @12:21PM (#34442887)
The QR that you mention, is just an encoding of an actual string key (edit: I'm reading now that it's called seed). If possible, it is better to get the string directly, instead of its QR encoded counterpart.

This is needed for example to store the TOTP in a device that has no camera. Or in your Bitwarden Pro account. Obviously you wouldn't be able to scan a QR with such an application, so the actual string is needed you just copy-paste it, so it should be provided by any service that offers 2FA (I confirmed Google does)

[ Parent | on HN ]
Re:Tell HN: It is impossible to disable Google 2FA using bac... by Xylakant on Thursday January 19, 2023 @12:24PM (#34442924)
You are correct about the QR code just representing a (fairly short) string, but applications can handle QR code just fine - 1password can read it directly from the screen.
[ Parent | on HN ]
Re:Tell HN: It is impossible to disable Google 2FA using bac... by lcnPylGDnU4H9OF on Thursday January 19, 2023 @12:32PM (#34443032)
There may be a plugin for it but the KeePass clients I've used don't support this by default. Generally, it would be best to look for the string (and keep both the string and the image secret!).
[ Parent | on HN ]
Re:Tell HN: It is impossible to disable Google 2FA using bac... by wingmanjd on Thursday January 19, 2023 @12:52PM (#34443280)
KeepassXC lets you store the TOTP seed value associated with an entry by right-clicking on that key and selecting "Setting up TOTP".

Also, other TOTP generators like Authy and Aegis let you backup your tokens to restore to another device.

[ Parent | on HN ]
Re:Tell HN: It is impossible to disable Google 2FA using bac... by pieter_mj on Thursday January 19, 2023 @01:35PM (#34443781)
Yes, but be careful which totp app you're using to store seed values/secret keys : some store them as plain text! Personally on android I'm using keepass2android and keepassium on ios to store both the QR image and the string value. It will also generate the OTP value at login. As you know, the keepass password file can be backed-up anywhere.

https://raw.githubusercontent.com/blues-lab/totp-app-analysi...

[ Parent | on HN ]
Re:Tell HN: It is impossible to disable Google 2FA using bac... by password4321 on Thursday January 19, 2023 @12:34PM (#34443052)
Why not both? Thanks for the clarification.
[ Parent | on HN ]
Re:Tell HN: It is impossible to disable Google 2FA using bac... by eigenvalue on Thursday January 19, 2023 @01:13PM (#34443536)
You can scan any QR code with the iPhone default camera app and get the string back that way. But yeah, all QR codes are just encoded strings.
[ Parent | on HN ]
Re:Tell HN: It is impossible to disable Google 2FA using bac... by 2fast4you on Thursday January 19, 2023 @01:24PM (#34443663)
Sharing a useful app I found: The Orca Scan app on iPhone can scan and decode all kinds of barcodes and qr codes
[ Parent | on HN ]
Re:Tell HN: It is impossible to disable Google 2FA using bac... by notpushkin on Thursday January 19, 2023 @02:51PM (#34444749)
Linux:

    xclip -sel clip -t image/png -o | zbarimg -
macOS:

    pngpaste - | zbarimg -
[ Parent | on HN ]