Looking for a service to display 2 factor auth codes online, rather than on my phone

Question

I am using my phone as 2 factor authentication.

I have some backup codes written down but in general - it would be a hassle to restore my credentials if my phone is lost.

I'm looking for 2 factor authentication online - a service let's call them 2FA-online that offers a personalised URLs (either password protected or not) so that when authentication code is needed - I visit the URL without relying on the phone.

A potential attacker would not know whether I use phone or 2FA-online so it appears safe to me - for the attacker any page would look as display of random, constantly changing numbers.

https://github.com/google/google-authenticator

The pluggable authentication module (PAM) is in a separate project.

I'm able to see C code and because it was written and maintained by Google guys it presents relatively high standard of coding.

I'm hoping that someone has already incorporated this code into their product!

PS. For similar reasons outlined above - not using encryption - too worried about securely storing private key...

EDIT / UPDATE: Me doing backups, wondering why I cannot simply extract the seed from Google Authenticator app: https://security.stackexchange.com/questions/172428/what-are-the-security-consequences-of-allowing-2fa-app-google-authenticator-to

Answer 1

It is very simple to write something like this.

Whether it's secure enough? It depends on how secure your 2fa-online web service is.

Here is a Python snippet using module oath which reads the base32-encoded shared secrets from the file given at first commmand-line argument and outputs a TOTP value with 6 digits:

# -*- coding: utf-8 -*-
"""
Generate TOTP value based on key read from file
"""

import sys, base64, hashlib, binascii

import oath

secret = open(sys.argv[1], 'rb').read().strip()

print oath.totp(
    binascii.hexlify(base64.b32decode(secret)),
    format='dec6',
    period=30,
    t=None,
    hash=hashlib.sha1
)

Answer 2

Using Authy: https://authy.com/

It allows me to install app on my phone / laptop, therefore removing single point of failure of losing phone and not having 2FA seeds backed up.

Single point of failure of losing phone, someone putting SIM into a new device resetting my Gmail (now they have Gmail and phone) remains.