iPhone/Mac 2FA authenticator apps

TidBITS Talk
21

Personally, I feel the “best practice” is the setup that you feel confident using and doesn’t make you feel overwhelmed. Otherwise, it’s easier to stop using 2FA and it can be easier for a scammer to create fear and doubt.

It can be necessary, unfortunately, to have authenticator apps only used by a single website. For example, one of my financial service providers uses Symantec VIP Access. The firm does not support Google Authenticator or any of the similar “generic” apps. Further, the Symantec app cannot be used for logins on more than one company’s website (a family member is a client of another financial service provider that uses S.V.A. but synching with their provider erases the synch with my provider). So I have both a Google and a Symantec authenticator app on my phone.

1 Like
22

Symantec VIP actually uses TOTP (the algorithm Google Authenticator and other such apps use) behind the scenes. If you google “python symantec vip”, there are a couple of Python packages available to generate a VIP token (which you give to the company using VIP when you add 2FA to your account there) and the corresponding TOTP key (which you add to your TOTP app). Then when the company asks for a VIP token, you give it the one from your TOTP app.

3 Likes
23

I just switched from Raivo OTP (which got sold, and there were many reported cases of data loss) to Proton Authenticator last week.

It works well on iPhone, iPad and Mac so far.

1 Like
24

I use Proton’s new 2FA app: Proton Authenticator: Private, secure 2FA authenticator | Proton It’s free and cross-platform; Apple, Windoze, Android. Also BitWarden as I use their password app; again free and cross-platform. Can’t use anything Apple as I have an Android phone.

1 Like
25

I’d suggest a solution in two parts:

  1. always keep the originating TOTP/OTP key code in a secure store such as a GPG encrypted file or Secrets. This means when you lose your phone or a provider evaporates, you still have your 2FA tokens.
  2. Use a command line app such as oathtool

e.g. oathtool -b --totp

or your own simple go program (which sports a nifty timeout counter) such as:

// simple totp key generator
package main

import (
    "fmt"
    "os"
    "strings"
    "time"
    
    tm "github.com/buger/goterm"
    "github.com/pquerna/otp/totp"
)   
    
// DSECS is the default timeout of totp
const DSECS = 30
    
func output(input string) (string, error) {
    return totp.GenerateCode(clean(input), time.Now())
}         

func clean(s string) string {
    return strings.ToUpper(strings.ReplaceAll(s, " ", ""))
}

func ttl() int {
    t := time.Now()
    s := t.Second()
    return DSECS - (s % DSECS)
}   
    
func show(input string) {
    tm.Clear()
    tm.MoveCursor(1, 1)
    tm.Flush()
    ticker := time.Tick(time.Second * 1)
    for { 
        c, err := output(input)
        if err != nil {
            fmt.Println("Error: ", err)
            os.Exit(1)
        }
        tm.MoveCursor(1, 1)
        fmt.Println(fmt.Sprintf("TOTP code valid for %2d:\n%s\n", c, ttl()))
        tm.Flush()
        <-ticker
    }
}

func main() { 
    if len(os.Args) != 2 {
        fmt.Println("no key found")
        os.Exit(1)
    }
    show(os.Args[1])
}

There is a debate about how secure it is to hold your authentication credentials on one device. TOTP was intended to help with people having different credentials on different devices (username and password on your computer, perhaps, and TOTP on your phone, for example). If you are interested in the portability and longevity of your credentials you may wish to consider a local solution. The tech isn’t difficult but security – as always – is tricky.

1 Like