Una Watch TOTP - MFA on your wrist! 0 ▲ Terence Eden 2 hours ago · 11 min read2293 words · Tech · hide · 0 comments Let's get this out of the way first - this is a terrible idea! I want my two-factor authentication codes to be easily accessible to me, so I've built a watch app which will display them. That's really convenient for me - but makes for a terrible security posture. Anyone who steals my watch will be able to see my one-time code. If they're clever, they can decompile the app and find the secret which powers the code generation. You should absolutely not do this and, if you ignore my warnings, you should only do this for codes which aren't critical to your security. In my defence, an attacker would still need my username and password to make any use of these codes - but please don't trust your security to my deranged witterings. What It Looks Like Prior Art I'm sure many other people have done this. Indeed, three years ago I built An eInk, Wrist-Mounted, TOTP Generator. The Service This is in my Service.cpp - as you can see, it's pretty simple. This won't let you add in hundreds of codes… No comments yet. Log in to reply on the Fediverse. Comments will appear here.