tfa.one

This is absolutely perfect for a use case that I've seen a lot: shared test accounts. Eg our app connects to external service X, so we have a staging account set up such that the…

Yep! I use that with my personal 1password. And honestly, that's probably the way we'll go eventually, but right now we're a super tiny startup - setting up a team 1password and…

One conscious decision made when building this was not to blast 2FA codes inside some channel where potentially anyone can see them, which would indeed be pretty bad when users…

Totally get the use case for this, lots of shared accounts in IT, been a problem for years that gets solved in a number of ways. Sometimes clever, sometimes barely duct tape.…

Like most of the services popping up around 2FA, now that 2FA is popular: this essentially removes one of the factors. Whether you're making one of the factors available to…

Most people have their phone as a 2FA device, but they will login to websites/services on their phone anyway. Would you suggest preventing logins from phones? The REAL benefit of…

Not just that... you're also sending those 2FA codes through yet another third party service (Slack), so you have two places where your security can be compromised.

I get the use case, but I just can’t get behind using software like this for security reasons. It’s too easy to add users to slack, leading to accidentally exposing secrets.

Using a separate device (yubikey, mobile phone, etc) is always recommended, but this is a bit more secure than meets the eye. Someone would have to get access to your Slack…

The use case seems to be to bypass any value provided in using 2FA in the first place...

Where does non-repudiation fit in if multiple people get the same 2FA code? You're trusting teamFA, Slack, and each team member's Slack accounts. This seems like a security…

I can see the use case in this (even though it entirely defeats the purpose of 2FA) but one glaring omission I see on the homepage screenshots is the lack of an audit log. I…

It doesn't say, but I presume these are TOTP codes, and there is just a single generator that you're sharing and thus one shared secret. This has some surprising consequences,…

Yup this is indeed a limitation in that once a code is used, the next person essentially has to wait at least one minute before they can get another working code. My target is…

I can see the use case in this (even though it entirely defeats the purpose of 2FA) but one glaring omission I see on the homepage screenshots is the lack of an audit log. I…

At the moment I don't log/track anything (I don't even store user emails), but I can see an audit trail being extremely useful. Thanks for the suggestion!

Is it possible to reconstruct the seed (or some equivalent that would allow you to generate future codes)? If yes, how many codes would you need to do so?

Do you know 1password handles storing mfa codes?

Can't the login with 2FA be shared with the team in 1Password, because 2FA alone is not enough to share a login. Not that sharing logins is a smart thing to do, but people still…

For that one vital service which doesn’t support multiple users on a single account (or locks it away behind an eye-wateringly expensive enterprise plan). Every org has one, for…

Bitwarden does this too

Bitwarden, and the fantastic rust-built equivalent Vaultwarden can be self-hosted, include granular, multi-user sharing of credentials which may contain TOTP secrets. The web…

Totally get the use case for this, lots of shared accounts in IT, been a problem for years that gets solved in a number of ways. Sometimes clever, sometimes barely duct tape.…

Would recommend hashi vault in place of this which can work for human/non-human workflows and a pretty robust security model with better auditing and authorization than slack.…