2

I am using my phone as 2 factor authentication.

I have some backup codes written down but in general - it would be a hassle to restore my credentials if my phone is lost.

I'm looking for 2 factor authentication online - a service let's call them 2FA-online that offers a personalised URLs (either password protected or not) so that when authentication code is needed - I visit the URL without relying on the phone.

A potential attacker would not know whether I use phone or 2FA-online so it appears safe to me - for the attacker any page would look as display of random, constantly changing numbers.

https://github.com/google/google-authenticator

The pluggable authentication module (PAM) is in a separate project.

I'm able to see C code and because it was written and maintained by Google guys it presents relatively high standard of coding.

enter image description here

I'm hoping that someone has already incorporated this code into their product!

PS. For similar reasons outlined above - not using encryption - too worried about securely storing private key...

EDIT / UPDATE: Me doing backups, wondering why I cannot simply extract the seed from Google Authenticator app: https://security.stackexchange.com/questions/172428/what-are-the-security-consequences-of-allowing-2fa-app-google-authenticator-to

  • Alternative: Using a 2FA app (e.g. AuthenticatorPlus) that has backup capabilites built-in. – SEJPM Sep 6 '18 at 12:36
1

It is very simple to write something like this.

Whether it's secure enough? It depends on how secure your 2fa-online web service is.

Here is a Python snippet using module oath which reads the base32-encoded shared secrets from the file given at first commmand-line argument and outputs a TOTP value with 6 digits:

# -*- coding: utf-8 -*-
"""
Generate TOTP value based on key read from file
"""

import sys, base64, hashlib, binascii

import oath

secret = open(sys.argv[1], 'rb').read().strip()

print oath.totp(
    binascii.hexlify(base64.b32decode(secret)),
    format='dec6',
    period=30,
    t=None,
    hash=hashlib.sha1
)
0

Using Authy: https://authy.com/

It allows me to install app on my phone / laptop, therefore removing single point of failure of losing phone and not having 2FA seeds backed up.

Single point of failure of losing phone, someone putting SIM into a new device resetting my Gmail (now they have Gmail and phone) remains.

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.