Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

TOTP with proper diligence (backing up your codes) is just about the best of everything. You aren't dependent on any third parties for an MFA factor; your email and phone providers may disappear, but your TOTP code is as secure as you've made it.


We're literally talking about people losing their codes. What makes you think most people even have a system to securely archive TOTP codes long term, much less actually think to do it?

What if an iPhone user uses Apple Notes to store their TOTP keys (probably one of the most reasonable ways accessible to a non-technical user), but then 5 years down the line switches to Android, 5 more years pass and they've entirely forgotten that they even used to put TOTP codes in Apple Notes 10 years ago, and then they need their TOTP codes?

Securely archiving things which are rarely if ever needed across many decades is an incredibly hard problem, and I would trust approximately 0% of users to do it correctly.


Is Apple Notes a TOTP program? At least where I do my thing, on AndOTP, there's a plainly obvious backup and restore function that saves or reads from a file. Doesn't get much simpler than that.


Apple Notes is a note taking program, it would be a place to store backup codes. You can't store your backup codes in your OTP app, that would defeat the purpose.


Hence the file. Backup to a file, copy it somewhere else. Heck, print it out on paper if you want to.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: