[{"data":1,"prerenderedAt":342},["ShallowReactive",2],{"project-28664267":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":5,"maker":10,"posted_at":11,"year":12,"points":13,"comments":14,"rank_in_year":15,"shown_in_year":16,"top":17,"tier":18,"category":19,"subcategory":20,"format":21,"keywords":22,"reception":27,"sentiment":28,"stance_mix":29,"scored_comments":34,"aspects":35,"strip":40,"post_text":41,"what":42,"said":78,"maker_in_thread":196,"shape":201,"grid":205,"attempts":300,"same_week":305,"maker_shows":219,"maker_hidden":334,"reader_version":335,"card":336},"28664267","tfa.one","Generate shared 2FA codes for your entire team","title","Show HN: Generate shared 2FA codes for your entire team","https:\u002F\u002Ftfa.one","hansy",1632687461,2021,49,41,866,2533,35,"shown","security_privacy","two-factor authentication sharing","web_app",[23,24,25,26],"shared 2fa","totp","team authentication","slack bot","roasted",-0.404,{"positive":30,"neutral":31,"mixed":32,"critical":33},3,5,1,12,21,{"privacy":36,"idea":39},{"positive":37,"critical":38},0,6,{"positive":30,"critical":38},[32,32,37,32,37,37,30,37,37,37,37,31,37,32,37,37,32,37,37,37,32,32,37,37,37,37,37,32,32,37,30,30,37,30,32,30,32,31,30,30],null,{"problem":43,"audience":54,"pricing":63,"motivation":68,"time_to_build":41,"stack":76,"openness":77,"stage":77,"team_size":77},{"value":44,"source":45,"evidence":46},"Teams need shared 2FA codes for shared accounts without giving everyone their own seat.","maker",[47,51],{"id":48,"by":49,"text":50},"28665567","fishtoaster","This is absolutely perfect for a use case that I've seen a lot: shared test accounts. Eg our app connects to external service X, so we have a staging account set up such that the…",{"id":52,"by":10,"text":53},"28665089","One conscious decision made when building this was not to blast 2FA codes inside some channel where potentially anyone can see them, which would indeed be pretty bad when users…",{"value":55,"source":45,"evidence":56},"Small teams, especially startups, sharing accounts.",[57,60],{"id":58,"by":10,"text":59},"28665251","Yup this is indeed a limitation in that once a code is used, the next person essentially has to wait at least one minute before they can get another working code. My target is…",{"id":61,"by":49,"text":62},"28673071","Yep! I use that with my personal 1password. And honestly, that's probably the way we'll go eventually, but right now we're a super tiny startup - setting up a team 1password and…",{"value":64,"source":65,"evidence":66},"Cheap, per commenter's remark on cost.","commenter",[67],{"id":48,"by":49,"text":50},{"value":69,"source":65,"evidence":70},"Avoid paying per-seat for shared accounts that require 2FA.",[71,72],{"id":48,"by":49,"text":50},{"id":73,"by":74,"text":75},"28666432","nikolay","Can't the login with 2FA be shared with the team in 1Password, because 2FA alone is not enough to share a login. Not that sharing logins is a smart thing to do, but people still…",[],"unknown",{"praise":79,"objections":89,"requests":145,"questions":153,"alternatives":161},[80,85],{"value":81,"source":65,"evidence":82},"Useful for shared test accounts and cheap team access.",[83,84],{"id":48,"by":49,"text":50},{"id":61,"by":49,"text":62},{"value":86,"source":45,"evidence":87},"Slash command avoids posting codes in a public channel.",[88],{"id":52,"by":10,"text":53},[90,105,119,130,137],{"value":91,"source":65,"evidence":92},"Gives a third party the TOTP secrets, a risky trust placement.",[93,97,101],{"id":94,"by":95,"text":96},"28665678","ShakataGaNai","Totally get the use case for this, lots of shared accounts in IT, been a problem for years that gets solved in a number of ways. Sometimes clever, sometimes barely duct tape.…",{"id":98,"by":99,"text":100},"28665720","remram","Like most of the services popping up around 2FA, now that 2FA is popular: this essentially removes one of the factors. Whether you're making one of the factors available to…",{"id":102,"by":103,"text":104},"28666002","tedk-42","Most people have their phone as a 2FA device, but they will login to websites\u002Fservices on their phone anyway. Would you suggest preventing logins from phones? The REAL benefit of…",{"value":106,"source":65,"evidence":107},"Slack as a delivery channel adds another attack surface.",[108,112,116],{"id":109,"by":110,"text":111},"28666102","tgsovlerkhgsel","Not just that... you're also sending those 2FA codes through yet another third party service (Slack), so you have two places where your security can be compromised.",{"id":113,"by":114,"text":115},"28664701","joshdev","I get the use case, but I just can’t get behind using software like this for security reasons. It’s too easy to add users to slack, leading to accidentally exposing secrets.",{"id":117,"by":10,"text":118},"28665149","Using a separate device (yubikey, mobile phone, etc) is always recommended, but this is a bit more secure than meets the eye. Someone would have to get access to your Slack…",{"value":120,"source":65,"evidence":121},"Shared codes defeat the purpose of 2FA and weaken accountability.",[122,126],{"id":123,"by":124,"text":125},"28664717","tossaway9000","The use case seems to be to bypass any value provided in using 2FA in the first place...",{"id":127,"by":128,"text":129},"28666388","whoknew1122","Where does non-repudiation fit in if multiple people get the same 2FA code? You're trusting teamFA, Slack, and each team member's Slack accounts. This seems like a security…",{"value":131,"source":65,"evidence":132},"Lacks an audit log.",[133],{"id":134,"by":135,"text":136},"28664812","jeroenhd","I can see the use case in this (even though it entirely defeats the purpose of 2FA) but one glaring omission I see on the homepage screenshots is the lack of an audit log. I…",{"value":138,"source":65,"evidence":139},"Shared TOTP codes collide when several users log in at once.",[140,144],{"id":141,"by":142,"text":143},"28665118","tialaramex","It doesn't say, but I presume these are TOTP codes, and there is just a single generator that you're sharing and thus one shared secret. This has some surprising consequences,…",{"id":58,"by":10,"text":59},[146],{"value":147,"source":65,"evidence":148},"Add an audit log of who requested codes.",[149,150],{"id":134,"by":135,"text":136},{"id":151,"by":10,"text":152},"28665099","At the moment I don't log\u002Ftrack anything (I don't even store user emails), but I can see an audit trail being extremely useful. Thanks for the suggestion!",[154],{"value":155,"source":65,"evidence":156},"Can the TOTP seed be reconstructed from codes?",[157],{"id":158,"by":159,"text":160},"28665691","cmeacham98","Is it possible to reconstruct the seed (or some equivalent that would allow you to generate future codes)? If yes, how many codes would you need to do so?",[162,174,185,189],{"value":163,"source":65,"evidence":164},"1Password shared vaults with TOTP fields.",[165,169,170],{"id":166,"by":167,"text":168},"28666293","auslegung","Do you know 1password handles storing mfa codes?",{"id":73,"by":74,"text":75},{"id":171,"by":172,"text":173},"28665170","jon-wood","For that one vital service which doesn’t support multiple users on a single account (or locks it away behind an eye-wateringly expensive enterprise plan). Every org has one, for…",{"value":175,"source":65,"evidence":176},"Bitwarden and Vaultwarden with shared TOTP.",[177,181],{"id":178,"by":179,"text":180},"28666320","weird-eye-issue","Bitwarden does this too",{"id":182,"by":183,"text":184},"28668659","jeffalyanak","Bitwarden, and the fantastic rust-built equivalent Vaultwarden can be self-hosted, include granular, multi-user sharing of credentials which may contain TOTP secrets. The web…",{"value":186,"source":65,"evidence":187},"LastPass TOTP support.",[188],{"id":94,"by":95,"text":96},{"value":190,"source":65,"evidence":191},"HashiCorp Vault TOTP secrets engine.",[192],{"id":193,"by":194,"text":195},"28666921","weirdo28","Would recommend hashi vault in place of this which can work for human\u002Fnon-human workflows and a pretty robust security model with better auditing and authorization than slack.…",{"comments":31,"answered":32,"key":197},[198,199,200],{"id":151,"text":152},{"id":58,"text":59},{"id":117,"text":118},{"commenters":202,"max_depth":31,"maker_replies":31,"first_comment_mins":203,"lifespan_hours":204},32,54,40,[206,208,209,213,215,217,222,224,225,228,232,234,236,237,239,241,244,245,246,249,251,252,253,256,258,259,262,265,267,270,271,276,279,282,283,285,287,289,293,297,298],[94,37,32,207,95,37],"project\u002Fcritical\u002Fprivacy",[109,37,32,207,110,37],[210,37,37,211,212,37],"28666890","commenter\u002Fneutral\u002Fnone","zxcvbn4038",[134,32,32,214,135,37],"project\u002Fcritical\u002Fidea",[151,32,37,216,10,32],"project\u002Fneutral\u002Fprivacy",[218,219,37,220,221,37],"28666655",2,"other\u002Fneutral\u002Fidea","LethargicStud",[48,30,30,223,49,37],"project\u002Fmixed\u002Fidea",[166,30,37,211,167,37],[226,30,37,211,227,37],"28666935","hnzix",[229,30,37,230,231,37],"28667098","other\u002Fneutral\u002Fnone","amichal",[233,30,37,211,227,37],"28668129",[61,30,31,235,49,37],"project\u002Fpositive\u002Fidea",[178,30,37,230,179,37],[141,238,32,214,142,37],4,[58,238,37,240,10,32],"maker\u002Fneutral\u002Fexecution",[242,238,37,211,243,37],"28665897","_wldu",[98,31,32,214,99,37],[102,31,37,211,103,37],[247,31,37,211,248,37],"28666301","bawolff",[250,31,37,211,99,37],"28681878",[113,38,32,207,114,37],[123,38,32,214,124,37],[254,38,37,211,255,37],"28664881","geofft",[257,38,37,211,142,37],"28665202",[117,38,37,216,10,32],[260,38,37,211,261,37],"28665502","akerl_",[263,38,37,264,10,32],"28665774","maker\u002Fneutral\u002Fnone",[266,38,32,207,194,37],"28666980",[268,38,32,207,269,37],"28665070","rmetzler",[52,38,37,216,10,32],[272,273,30,274,275,37],"28665061",7,"project\u002Fneutral\u002Fidea","chews",[277,273,30,216,278,37],"28665159","jamesvnz",[280,273,37,211,281,37],"28665400","fragmede",[158,273,30,216,159,37],[182,284,32,214,183,37],8,[73,286,30,274,74,37],9,[127,288,32,207,128,37],10,[290,291,31,235,292,37],"28676494",11,"kevinlst",[294,33,30,295,296,37],"28664965","project\u002Fneutral\u002Fnone","antondd",[171,33,31,235,172,37],[193,299,32,214,194,37],13,[301,304],{"id":302,"t":303,"points":32,"comments":37},"28455798",1631102367,{"id":4,"t":11,"points":13,"comments":14},[306,311,316,320,325,330],{"id":307,"name":308,"points":309,"category":310},"28670252","Tidy Viewer",392,"dev_tools",{"id":312,"name":313,"points":314,"category":315},"28680136","Extract Table",217,"data",{"id":317,"name":318,"points":319,"category":310},"28669703","SQLite Playground",213,{"id":321,"name":322,"points":323,"category":324},"28697828","Ampie",194,"productivity",{"id":326,"name":327,"points":328,"category":329},"28683231","Firezone",183,"infrastructure",{"id":331,"name":332,"points":333,"category":310},"28636540","Go Playground WASM",140,false,"v2",{"id":337,"name":5,"line":6,"ai":334,"cat":19,"year":12,"points":13,"comments":14,"rec":27,"s":338,"top":17,"kw":339,"maker":10,"domain":5,"tier":18,"attempts":219,"strip":340,"url":9,"mix":341,"praise":81,"objection":91,"sub":20},28664267,-0.4,[23,24,25,26],"1101003000050100100011000001103303131533",[30,31,32,33],1793991033857]