Comment by jvanderbot

Even if you only have the QR code, you can download the image or screenshot it and then extract the secret without ever having to use a smartphone by using zbarimg and then manually extracting the secret from the URI:

    sudo apt-get install zbar-tools oathtool
    zbarimg qr-2fa-code.png
    

    QR-Code:otpauth://totp/username?secret=ABCDEFSECRET012349BASE32&period=30&digits=6

Just to add, 'pass' has an otp extension to simplify this a bit [1]

With that, you can do

    $ zbarimg -q --raw qrcode.png | pass otp insert <some-name>
    $ pass otp <some-name>  # or pipe to xsel

We also have Microsoft authentication that displays a number on the browser and asks you to enter in on the device! :-(

I've worked in places that wanted to push cell phone apps on the team for auth and we also pushed for hardware tokens. It worked extremely well. The concerns we had were mainly centered on privacy since the app wanted location/camera access and apps can (or at least at the time could) get a ton of data from your device without requesting any permission at all like getting a list of every app you have installed, or data from sensors like the accelerometer, gyroscope, compass, barometer, thermometer, etc.

Sounds like a job for a second phone, one which you'd just be extra careful to only use for one purpose. It can be cheap as balls, but it will have a QR-compatible camera and whatever else we may have come to expect from such a device. :)

Make sure your GNSS receiver supports OSNMA, and be _extremely_ trusting of your battery-backed RTC and profoundly skeptical of time jumps over a certain magnitude.

GNSS spoofing is trivial now and it's an extremely useful way to manipulate a target device's idea of time, which breaks all sorts of things. (SSL certificate validity periods...)

This is nearly what you’re looking for (well, not that close, but it’s got the right spirit):

https://blog.singleton.io/posts/2022-10-17-otp-on-wrist/

I would love this, but only if it also successfully implemented a few disparate authentication protocols that essentially do the same things (prove identity) but are regrettably proprietary - like the de facto standard electronic ID in Sweden, BankID.

Token2 make this: https://www.token2.com/shop/product/molto-2-v2-multi-profile...

They also do single-token cards: https://www.token2.com/shop/category/programmable-tokens

Yubikey?

A yubikey works great for this

they exist, in my country they are available as alternative to smartphone apps for identity auth. (ie you can choose between android, iphone, and TOTP LCD device.)

Flipper Zero supports that

[dead]

I imagine Yubikey doesn't support all the stupid custom-app-2fa that companies push out.

I really wish they'd just stick to classic TOTP.

Is there a way of getting them to store a dozen or so totp secrets? And if so, how do you select which one you want to use?

Taking the 2 out of 2FA since 2017!</sarcasm>

Thanks for sharing a potentially useful tool but I will not use it without a lot more details about how this browser extension secures the 2FA secrets from sketchy websites/ads.

I just use an old phone that I've wiped clean and removed the SIM. Sits on the desk and I just glance at it when I need a new 2FA code.

Defeats the purpose of 2FA though. I'd argue a cheap 2FA-only phone would be good, if they're struggling to touch their real phone without being consumed by distractions.

I carried 2 phones for many years. It was more trouble than it’s worth. Especially these days. Working from home, my only work use of the phone is for the Authenticator app.

The optics of that can be questionable. Just ask Skyler White or her brother-in-law.

I see some evidence that yubikeys are used somewhere in the organization, but not sure where or how.

The only information we were sent to get this all setup was specifically for a phone. The portal that exists to add devices only appears to support phones.

I have a co-worker who simply tried to use Authy instead of MS Authenticator and it didn’t work. There is a lot of bureaucracy that typically makes it not worth the fight.

I use MS Authenticator for work too. It doesn't do standard TOTP, at least not for Entra. The QR codes don't contain the secret. IDK that anyone has been able to exfiltrate a secret and generate codes with a third party app.

I personally use an Android emulator on my laptop, which achieves the same goal. It saves and restores state automatically for quick startup.

The comments here have the genre of "2 factor, 1 device"...

Even doing nothing beyond the authentication, it is still requiring task switching, changes devices, waiting for codes, entering them, switching back. It’s very disruptive to any type of flow state.

But it's in their best interests.

> This stops working after a while.

yeah and i figured thats fine !

I take time spent on HN as an example. I used to think if i limit my HN time to under 10-15 mins a day, would be ideal. But the slippery slope was stopping. It felt rude. And i had no one but myself to get angry on. Weird loop.

I then go the opposite, allow myself to binge. Kinda forced looking at HN every occasion i had a few mins. I get bookmakes to avoid typing the url. Browse on every device. Add comments, browse past lists, front page, best comments, etc. All the dopamine boosts. And I notice the dopamine effect reduces. The fun in comments, upvotes and finding something new just evaporates. A day or two of this makes me sick of the orange banner and the beige background. I delete bookmarks, remove everything. Make a new account to start fresh. Add a rule to block the domain, all out of a natural reaction, mind you.

i dont have real stats but it feels like over 2 years of this, i've spent less time on HN, than before. I'm not constantly fighting myself. It comes and goes in waves, like seasons of nature. Right now its spring and slowly getting into HN summer as explained by my flurry of comments past few weeks.

Yeah. Sometimes the reason you can't focus on something is that some part of your brain is trying to tell you that you shouldn't.

Unfortunately, that part of the brain usually sucks at coming up with an alternative plan, and "do something else, anything" is not very actionable. And you still need to pay your bills somehow.

The natural reward for work is work done. I don't need a motivational system to do the dishes. The motivation is seeing the dirty dishes gradually disappear, and the kitchen become cleaner. I don't need to create pieces of papers to represent that, because it is already happening right there, in real life.

If I work on a project, it helps to specify all things that need to be done (as opposed to working on something open-ended), so that I can see how I am getting closer to the moment of "done". A nice thing about test-driven development is that you produce a set of checkboxes first, and then you gradually check them off. Even if the work is open-ended, if I keep thinking about new features that would be nice add, it helps to specify a "version 1.0", and after achieving it, a "version 2.0", etc. The idea is that after each version I can take a break and feel that my work is done.

The least motivating thing is probably the job, as an employee. You work for 8 hours a day (generously assuming no overtime). There is no way to complete those 8 hours in e.g. 4 hours of working harder and then take a walk. In theory, if you do Scrum, you should have a certain reasonable amount of work assigned per sprint, and if you do it faster, then I guess you can take a short break and do something enjoyable (such as refactoring). In practice, almost no one does Scrum by the book; you will probably be randomly interrupted by extra tasks, and given unrealistic deadlines to avoid the possibility of completing the work earlier.

Another demotivating thing about the job is that there is no personal consequence of completing a project; you immediately start working on a new one. The natural response to completing a work is to congratulate yourself and take a break. But at work, the vacations are mostly unrelated to projects. Also, you are paid per time spent working, not by the number of projects finished. So it is all disconnected.

So I guess it all needs to be a part of some greater project, which can possibly be completed one day. Such as, putting your money in index funds, and planning to retire as soon as you reach a specified amount. Then each day you can congratulate yourself for getting 0.01% closer to the goal. (Or you can save money for other specific things, if that is what you desire.)

I posted in another thread how reliable some old/popular answers can be. Frustratingly so. :D

Exercise is annoying, as without a lot of modern life, it largely takes care of itself. Back when I could just walk to a grocery, as an easy example, it was unsurprisingly easy to stay in decent shape.

This feels overstated. Though, it isn't like current affairs aren't trying their best to make the overstated seem tame. :D

I find this intensely amusing. In grade school, I got "mono" and dang near literally slept for several days. Granted, being sick is a bit different than being disinterested.

My problem is typically more that there are plenty of more interesting things to do than anything I'd like to do right now.

I think this is more akin to literally starving yourself so that a single bit of spinach tastes great. It turns out you can in fact eat a candy bar and have pizza and not become obese or otherwise damage your health. It's not one or the other and OP might need some kind of professional help to mediate their moods...

Like this is clearly not healthy.

That’s insanely stereotypical. There is no ”drugs” that is ”the purest form of pleasure”.

Instead, there are many thousands of different substances which can elicit, heighten, prolong or enable pleasure; some illegal, some legal, some included in your favourite meals and snacks.

Even vanilla is a ”drug” which enhances pleasurable feelings. (Vanillin and ethylvanillin are monoamine oxidase inhibitors and consuming them will increase serotonergic and dopaminergic activity)