Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I went though a similar problem about 10 years ago. In my case, the phone (iPhone 4S) wasn't lost, but it's clock was perpetually off. The WiFi radio had failed and the Stratum 1 time server on my mobile network seemed to be sending it the wrong time. This resulted in all of the MFA TOTPs getting rejected and me not being able to access Gmail for a year. Despite the clock issue, many things still worked, presumably because this was still back when much of the internet used either weak or zero TLS/SSL.


There is no such problem as you describe, because you were never limited to a single device like that. You just didn't know it because both the totp app and the site that used it conspire to not tell you something very simple.

Which is that all you need is the seed value from the original qr code or url, or sometimes it's even just displayed in plain text on screen. But it's perfectly readable from the url or qr code too. That value is all you need to generate valid current totp codes on a new device, or on 30 different devices and platforms all at the same time.

It's no more difficult or risky than any other password. It's just a short random string you have to store any way you want anywhere you want any number of copies and forms you want, and can use on any new device you want at any time.

You can have as many working totp generators as you want, all at the same time. You can spin up a brand new device from scratch any time you want.

But the apps and sites don't tell you about that, and instead give you the one-time-use emergency codes, and only display those one time, and if it's 10 years ago and the whole process is a mystery, you can easily blow through that screen without realizing it was actually important to capture those and then not lose them. (And with the seed value, the emergency codes are no longer important.)

In the case of your defective phone, had you known to save the original seed value, you just grab any other new phone, or your laptop, or anything, install whatever totp app you like on that, fetch your password db however you like (that doesn't itself require totp), and add the saved seed values in the new totp app, and it starts generating current valid totp codes.

keepass actually does both in the same app. It can not only store the seed value just like a password, it will also display/clipboard the current totp code the same as any other totp app directly itself.


That's assuming the seed value is given to you at all, and not hidden inside a custom app.


Yes! That is exactly what I did in the aftermath of that iPhone 4S fiasco. I went though some iterations of Android phones and made sure I got the TOTP seed in the MFA app on both devices. Eventually I moved onto TOTP apps that can sync these and stopped worrying about it.




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: