Hacker News Reader

I always refuse to use the "scan QR code" thing, and everybody I've tried that with (at least Google, Amazon, Github, Dropbox, Linode) give you a TFA secret to type in as an alternative - I then store these in 1Password and can back that up and use them to key Google Authenticator on additional devices. (I've never tried to extract or backup.reuse secrets from Authenticator.)

View on HN

In 1Password premium, you can put the secrets directly as TOTP in a login item (on your phone) by scanning a qr or entering the secret. Then 1Password will generate the OTP for you. It then also works nicely in the desktop browser.

This only works for services using TOTP mode; HOTP prevents replay/cloning attacks.

The HOTP counter is something you can increment yourself if needed when storing it somewhere?

Proper implementations of TOTP do not just rely on expiring the codes. From chapter 5.2 of RFC 6238: "Note that a prover may send the same OTP inside a given time-step window multiple times to a verifier. The verifier MUST NOT accept the second attempt of the OTP after the successful validation has been issued for the first OTP, which ensures one-time only use of an OTP."

Yep, right at the top of page 7 of the RFC: https://tools.ietf.org/html/rfc6238

If it accepted the same token more than once, it couldn't possibly be called a "one-time password".

Reply on news.ycombinator.com