Skip to main content

www.tmkn.org

← Blog

TOTP without a smartphone

Difficult part of ditching a smartphone is deciding on how one may deal with one-time passwords. Everything around just tells you to download “Google Authenticator” app.

I have decided that I won’t be able to do a multi-factor authentication without a smartphone when I am on the go and can only do it on my only smart device - a computer. That means I can only take advantage of one-time passwords without added benefit of a multi-factor authentication.

One-time password seed stored on the same device as passwords is still a massive advantage over just using passwords.

Most popular password managers such as 1Password or Bitwarden allow adding TOTP tokens to them. It’s convenient. Still, you can take this further by putting your TOTP seeds into a separate basket on the same device. Use a different application for your TOTP tokens. Also, if you secure your password manager with TOTP, you will need somewhere to store that token seed anyway.

I personally use KeePassXC to do that. It’s a cross-platform application that allows to generate TOTP tokens stored in a local encrypted database file. I only store TOTP seeds in the KeePass file. Passwords are stored in a separate password manager.

This way even if your password manager gets compromised, you can still have your accounts safe because your TOTP seeds are stored in a “separate basket”.

This may not be a good option if you don’t trust your computer. I personally feel like I can live with this risk given the benefit of not having a smartphone.

Another option may be SMS codes. I try to avoid using them if I can. Maybe it’s as viable as storing my TOTP seeds in a KeePass file on my computer? Not all websites offer SMS codes anyway. In the real world you have to use both.

I have not really considered hardware option for the multi-factor authentication. Mostly because it sounds like a faff and it comes at an extra cost. Maybe I could store all my TOTP seeds in the password manager and then secure my password manager with a hardware token?

PS I highly recommend backing up your TOTP seeds and/or recovery codes by printing them out and storing them securely at home. Computers can go missing.

← Blog