Ask HN: How many 2FA tokens do you have?

https://news.ycombinator.com/item?id=30566604

by edent • 4 years ago

25 67 4 years ago

news.ycombinator.com

I currently have 43 TOTP tokens in an app.

That feels like a lot, and is starting to get unmanageable.

I also have a handful of services tied to a Yubikey. But I've no way of knowing how many.

So, how many do you have?

Klaster_1• 4 years ago

Only a single Yubikey. After the purchase, I expected lots of service to implement WebAuthn, but none that I use bothered to, except for select few. I touch it once a year at best.

cpach• 4 years ago

12.

smoyer3• 4 years ago

I have three Yubikeys that I use for TOTP and that house my GPG keys and SSH key. At any given time, I have one on my person, one in my home office and one off-site. I only use TOTP on the Yubikeys for "critical accounts" and use oathtool and password-store to perform TOTP for most accounts (in Firefox via passff).

Password-store features git push and pull so I keep my encrypted passwords and TOTP keys on a couple remote Git servers. Because I use passwords that I don't know for every service, the Yubikeys are really more about being a safe way to back-up and transport my encryption key. If I've got that, I can always decrypt my passwords.

edent2• 4 years ago

How do you sync the Yubikeys if they're in different locations?

Like, if you're at work and sign up to a new service - how do the other two get associated?

Sorry if that's an obvious question.

smoyer3• 4 years ago

I do rotate which key is off-site. For the "critical sites" this means I've only got two keys registered for some period of time. I don't use the TOTP on the Yubikeys for most sites so signing up for a new service involves generating a new TOTP key with oathtool and saving that in password-store (along with the URL and login name) when I generate the password.

kdtsh• 4 years ago

This sounds like a neat arrangement. How do you go about this when you’re on the go? - do you have an app on your phone which support unlocking your password-store using a smart card, or do you just not manage passwords/MFA except on your computer?

smoyer3• 4 years ago

Each of my phones has its own private key and can decrypt the stored passwords. Having a private key protected only by a six number passcode is obviously a weak point in my security. Since password-store is encrypting each password with seven or eight public keys, it's relatively easy to revoke a compromised key and to re-encrypt all passwords/TOTP keys (excluding the compromised key).

I mostly generate passwords and add entries to my password manager from a computer but I've got all the required public keys on each device so it's theoretically possible to manipulate the password-store from a phone or tablet as well.

weird-eye-issue• 4 years ago

Unrelated but no joke I have something like 600-700 accounts stored in LastPass

edent2• 4 years ago

I've just checked - and I've accumulated over 1,000 in Bitwarden!

maxclark• 4 years ago

1395 logins saved. Don’t see how to filter/search for 2FA

BLKNSLVR2• 4 years ago

4 in Google Authenticator and 21 in Authy, 1 of which may have been superseded.

One service I use has four separate 2FA tokens to use with different service functions, and I have one account for me and one for my wife, so that single service accounts for 8 of 21 Authy tokens.

danesparza• 4 years ago

29 in an app. I use Keepass heavily for password storage.

jwr• 4 years ago

Two Yubikeys (you always want to have two) and 28 TOTP tokens. I wish more services would support Webauthn.

captn3m0• 4 years ago

35 in my main 2FA app (Tofu), and 4 Yubikeys configured as U2F in 6-8ish accounts. I also have a few TOTPs in one of the Yubikeys (which has a limit of 32).

account-5• 4 years ago

I have none. I use keepassxc to manage all my accounts.

I try to avoid 2FA. I have other strategies around account compromise.

_wldu• 4 years ago

Relevant blog post: https://www.go350.com/posts/now-they-have-2fa-problems/

Ideabile• 4 years ago

There is only one real answer to this: too many.

laurent92• 4 years ago

Why can’t websites show a QR code that my TOTP app recognizes and validates?

tialaramex3• 4 years ago

You're going to need to explain a little more of your idea. What does this QR code do? What happens if I put the Google.com QR code on my web site? What does your TOTP app do with this QR code when it sees one? Stuff like that.

firecall• 4 years ago

61 2FA tokens!

More via phone number 2FA as well!

And a lot of passwords saved.... my app doesn't give me a count. Probably need to look on desktop :-)

ur-whale• 4 years ago

I manage them with this:

https://github.com/pcarrier/gauth

cr3ative• 4 years ago

45 or so. But - they're all in 1Password, so the management is done for me. I don't have to scroll to a particular entry, it autofills everywhere I have to use them.

I also have a handful of yubikeys for more secure things.

rwieruch• 4 years ago

Does it make sense to have passwords and OTPs at a space with the same attack vector?

mmxcz• 4 years ago

Yes. It's not 2FA anymore but it still protects you when your password gets leaked.

wasmitnetzen• 4 years ago

That's not 2FA anymore though, if you regular password is also stored there.

Closi• 4 years ago

Eh, if your 1password account is breached it’s pretty much a game over scenario anyway for most users.

Youden• 4 years ago

2FA is "something you have" + "something you know". A password manager vault can be "something you have" and the password to the vault can be "something you know".

trulyrandom• 4 years ago

71 in total. I store all tokens in Aegis and have automatic backups configured, so I don't find it to be too unmanageable. It's seem like a lot, but then again I also have hundreds accounts in my password manager at this point.

msoad2• 4 years ago

Wide Web Authn[1] adoption can't come soon enough! This is so stupid! All I need is a single private key to login to all the websites!

I personally like to keep it in my iCloud account because I don't trust myself with keeping a private key for too long.

[1] https://webauthn.io

dorianmariefr4• 4 years ago

OTP is much simpler, I still don't know how I will be able to implement Webauthn for rubygems on the command line

msoad2• 4 years ago

for command line stuff you should be using public key actually

tialaramex3• 4 years ago

What is "rubygems on the command line" ?

From the replies it sounds like this is talking about client software? An unattended client should not be able to do WebAuthn as the whole point is that a human is present and authorising the authentication step - this is part of its defence against remote attackers, if I have 100% full of Bob's device I still can't touch the sensor or button to authenticate as Bob.

However, if you mean the human is present and running command line apps, that's fine, definitely possible. The authenticator is typically a USB device, it speaks HID (like a USB keyboard or mouse) but a specific custom HID protocol for this purpose, you can get a library to help talk to it, and that's how OpenSSH works with Yubikeys.

Now, OpenSSH is specifically telling the authenticator "I'm SSH, not the Web" but for "Rubygems on the command line" you could choose either to say "I'm a web browser" or, you could say "I'm this custom rubygems on the command line thing" and that gets you public key signed messages that are unique to your thing, verifiable by a remote system as not "WebAuthn" but "Custom rubygem thing".

Apple and Google (for the Android ecosystem) actually do all this today for phones, if you use a Web browser you get WebAuthn, but from a normal phone app you can do the exact same Usernameless/ Passwordless login like WebAuthn, but using a custom per-app message that can't be impersonated by other apps on the same phone.

simonbarker875• 4 years ago

Related: anyone have a good 2FA backup solution? Like if I loose my phone at this point I’d be pretty stuffed as my Google Auth app would be gone and my text 2FA also gone in the same moment.

BLKNSLVR2• 4 years ago

You can export Google Auth tokens and reimport them on a separate device.

Authy seems to sync between the 2 devices I have with it installed (which indicates that it's stored "in the cloud").

I always have second device mirroring the important stuff on my primary device. Usually my most recently replaced phone.

simonbarker875• 4 years ago

As I was typing the question I thought “I guess my old phone could do the job?” I’m wondering there is a middle ground option.

toastal3• 4 years ago

I wouldn't trust closed source services for something this simple. Authy wants your phone number and Google wants anything it can get its hands on. There are plenty of open source options with backup options.

habibur• 4 years ago

This. I am pretty scared of losing my phone too.

Reinstalling the app didn't seem to revive the tokens, last time I tried.

simonbarker875• 4 years ago

Yeh, 2FA through an authenticator app feels so fragile for the consequences of something going wrong.

refurb• 4 years ago

And as far as I know you can only have one device enabled with Google Authenticator at a time?

If it could be on multiple devices then I could set up an old phone and have it as a backup.

Edit: I’m wrong. You can sync two Authenticator apps using the same QR code during setup.

dorianmariefr4• 4 years ago

You usually have backup codes, you can print them, send them to yourself in your emails, have them in a passport manager, as notes, etc.

simonbarker875• 4 years ago

Sure, that’s a massive pain in the butt though. I’m thinking about something that allows me to get back up and running with the same system relatively quickly.

petepete2• 4 years ago

I use BitWarden for 2FA via their paid plan (£10 per year).

My BitWarden account is secured by Yubikey, of which I have two.

simonbarker875• 4 years ago

Ok, think I need to look at Yubikey as it keeps coming up here. I have a paid LastPass account, maybe there is something in there I can use.

willis9362• 4 years ago

TOTP is based off of a shared secret, so keeping that secret backed up is possible. I keep all of my TOTP tokens in a keepass database that is synced to my computers. If my keepass database is ever stolen and the encryption defeated then I'd be hosed, but I have a feeling there would be much worse problems in the world on that day.

AndrewOMartin• 4 years ago

Isn't the whole point of 2FA to keep you safe if your passwords get compromised? Seems like you may as well not bother with it.

I guess this means that any attacker will need to compromise your keepass database rather than just one of your other passwords, but it would help avoid a potential "hosed" scenario.

Maybe you think you're more likely to lose your phone then leak your master password? Perfectly reasonable I suppose :)

u2077• 4 years ago

I use strongbox[1] on iOS and it has a feature to print off your entire database (automatically formats everything). The passwords are stored in a standard kdbx file that you can sync manually or use drive, iCloud, etc. KeepassXC[2] has browser extensions and cross-platform apps and pairs well with strongbox. (No print feature afaik) Both apps are open-source.

[1] https://strongboxsafe.com/ [2] https://keepassxc.org//

giaour• 4 years ago

When you set up Google Auth for a site, you can capture the seed value and back that up. 1Password has TOTP (Google Auth protocol) support baked in if you're looking for a way to use TOTP without relying on a single physical device.

woleium• 4 years ago

LastPass authenticator uses centralized (encrypted) storage of keys

1MachineElf• 4 years ago

Use Bitwarden. You can back up everything into an encrypted JSON file - including your 2FA TOTP stuff. Import it into a self-hosted Bitwarden too, if you like.

EDIT: Exactly as petepete said. Multiple FIDO tokens like Yubikeys are supported.

gregjor• 4 years ago

iCloud Keychain works across devices, backed up automatically to iCloud. Only for Apple devices but works great.

frizlab• 4 years ago

I have 76 (mix of perso and work accounts ~50/50)

sshine• 4 years ago

Mostly cloud services, version control, email.

yesenadam• 4 years ago

None. I think - I don't know what they are exactly.

toastal3• 4 years ago

I have 24 keys in andOTP. I have the backed up with password-store and the OTP plugin. I also have my most frequently used ones on profiles in my hardware OnlyKey which can support FIDO2, TOTP, Yubikey's special format, text passwords and more. I have 2 of these keys, the other in a fire safe. I'm not really concerned with losing a single device because of redundancy.

The things I hate about the 2FA process:

1) requiring a phone number, especially only having SMS for 2FA like my foreign bank (I've reported the issue with SIM swapping with them on support and in person, but considering their system still isn't UTF using a very old encoding so I can't even type a comma in a message without errors, I'm not holding my breath)

2) not offering WebAuthn, especially as a big firm

3) Supporting specifically Yubikey and not FIDO2/WebAuthn

4) using some bullshit closed-source wrapper around TOTP like Symantec VIP that doesn't have a Linux client and requires me to use some random Python script to get spoof a Mac system to get a code (thanks Schwab)

synthos• 4 years ago

Is this the Symantec script you're referring to? https://github.com/dlenski/python-vipaccess Once you follow those steps you can generate codes from any TOTP system (Yubi, Android, etc).

toastal3• 4 years ago

Yes, but it says that it's brittle because it needs to spoof a specific Mac UA and this is not the most user-friendly process—especially for a newbie that switched to Linux and isn't used to the terminal and Python, but wants account security. I emailed support to just use TOTP because this step is dumb.

If Symantic wants to see TOTP as a service that's fine, I guess, but I just picture an astronaut with a gun saying it was just TOTP the whole time. Meanwhile they try to sell hardware keys around the obscurity layer of their product.

JohnFen• 4 years ago

None.

Well, two, technically, but I'd lost them long ago.

anotherhue• 4 years ago

I've used lastpass, Keepass, 1password (which can store TOTP codes) but I've moved entirely to a Mooltipass. Easy to backup, less fuss all around. (It does TOTP). Open hardware.

https://www.mymooltipass.com/

Thristle• 4 years ago

4 for work 10 personal

They are getting a bit hard to handle mostly because my app (authy) doesn't have a good enough set of icons

spansoa• 4 years ago

Did you backup the 'seed' QR-CODE somewhere safe? If you lose access to Google Authenticator, you lose the ability to use OTP for access.

Ask HN: How many 2FA tokens do you have?

Related Stories