Comment by al_borland

You should try a CLI-based workflow for 2FA. As long as you can exfiltrate the secret (and you often can by pretending you can't scan QR codes), then you can use oathtool to generate passcodes.

1. use 'pass' to save the secret: 'pass edit work.secret' <enter it and quit>

2. use oathtool to generate 2fa given a secret:

' #!/bin/bash

oathtool -b --totp "`pass show $1.secret`" >&1 '

use it like '2fa work'

If you have 'xsel' you can even do

'oathtool -b --totp "`pass show $1.secret`" | xsel -ib'

to copy it to clipboard automatically.

In my union contract we have language that requires the employer to provide us with a hardware 2FA token for just this reason. I and some of my coworkers don't use smartphones, and we didn't want to be obligated to use one for work.

"So long as [employer's] access management vendor... supports the use of physical two-factor authentication devices (for example, a YubiKey), [employer] shall make such devices available to Employees upon their submission of a request for the device."

I'm old enough to have lived through the era of standalone authenticators. The downsides of that approach are also numerous.

I understand where you're coming from though, and I think this is where OS features like Focus Modes come into play.

When I'm in a "Work" mode, I literally don't see notifications from most of my apps. They don't show up in the notification center, or on app icon badges, or anywhere.

This takes a few minutes to set up, but once it's in place, it's fantastic. I also do this for other aspects of my life: Photography, Research, etc. When I'm in those modes, I don't want to see anything except for the apps that are specific to what I'm doing. It's worth the effort of setting this up IMO, and extends far beyond just work.

Hmm. I wonder if there would be a market for a super simple TOTP authentication device with an e-paper display. Kind of like those RSA tokens with the LCDs, but more modern and able to hold any number of TOTP credentials.

Getting the credentials loaded could be a bit of a pain without a camera for QR code scanning. Easiest solution would be via Bluetooth to a companion app, which you would probably want anyway for periodic time sync (likely wouldn't be worth it to embed a GNSS receiver just to update the time).

Probably be a pretty small market, but as a niche Kickstarter device? I could see a small but loyal customer base.

Have you tried a smart watch? The Duo 2FA app lets you add an arbitrary TFA code based authenticator with same QR code Google Authenticator supports and generate those from their Apple WatchOS [0] or Android WearOS apps. I have used it successfully for years, it's a huge reason I got an Apple Watch in fact. Now you'll have to configure your watch with a "work" focus mode that turns off all notifications and not install any fancy apps on the watch (do those still exist?), but it can free you from your phone.

Along the same lines the Meta Wayfarer[2] smart glasses lets you take slice of life photos and videos without needing to whip out your phone. You lose a ton of quality but stay in the moment more. The AI features are getting better so eventually you'll be able to use it for basic information lookup.

0 - https://guide.duo.com/apple-watch

1 - https://guide.duo.com/duo-wear

2 - https://www.meta.com/ai-glasses/wayfarer

Yubikey nanos are the way out of that specific problem

Check this out: https://github.com/Authenticator-Extension/Authenticator

This is one of the thing that smart watches should be doing, or even better, something like https://blog.singleton.io/posts/2022-10-17-otp-on-wrist/.

First of all, I'm not a fan of constantly needing to re-authenticate.

But for your specific problem there is a simple solution that isn't particularly expensive. Buy a new phone. Install 2FA on it, and don't install anything else.

I imagine you've considered it already, but maybe your work would be willing to put the 2FA secret into something like 1Password, which you could access on your computer instead of your phone.

Time to get a “work” phone.

If it's Authenticator you can use bitwarden from your browser, that's what I do. If you're using a custom app or something different then yeah it's annoying

Get a keyboard with a usb port on the side. Insert yubikey nano. Now instead of annoying 2FA you just reach your finger over and touch.

Why does it have to be an app on your phone? IT should be able to support yubikeys (or similiar) and even printed OTP lists.

Apple Watch with Authy is a great solution for this. I don’t need to have my phone in the same room to use 2FA.

> However, it’s all via an Authenticator app on the phone.

Why not save the secret on your laptop and generate the OTP on your laptop?

You can use the Freedom app.

url freedom.to

Or just disable notifications. The iphone has a do not disturb mode that can be scheduled.

Most password managers (Bitwarden, 1Password etc) have a function for generating TOTP codes.

For Windows, here's a free little authenticator app that lives in your system tray: https://github.com/richard-green/Authentiqr.NET

These look swish https://www.reiner-sct.com/en/produkt/reiner-sct-authenticat...

Ever since I disabled all the notifications on my phone my life has been happier. It won't work for everyone (50% of the time it doesn't even work for me), but I can't help but write this anecdote here.

Get a Yubikey or similar, have a USB port close, one finger tip, done.

1Password can be your 2fa and autofill those fields. It has a built in scanner which will look at your screen and read the QR code on the screen (no separate device needed).

Reminds me of when I was developing an application 'in' Facebook (when it was mostly friends but with adds for addictive games in the sidebar)

Invest in a password manager that stores it all, including the rolling codes

Use a yubikey

do you use a pw manager? bitwarden (OSS) has it built in if you pay for premium. i think it's an extra 1-3/mo but well worth it to support the team

It's not your job's responsibility to cater to your lack of self control