Hacker News new | ask | show | jobs
by jumhyn 1750 days ago
FWIW, iOS 15 lets you put a TOTP secret right into the saved password entry on your phone, and it will autofill the code just like it autofills your password.
2 comments

Will I be able to export? When I moved to iOS, AndOTP saved me because I could copy paste all personal keys from AndOTP to MS authenticator. This will probably lock me in…
On iOS each password item in Settings.app has a "Share" button that lets you AirDrop to another device. I don't see another way to export from iOS.

Safari on macOS (at least in Monterey) offers a bulk export option, which can export all your passwords to an unencrypted CSV file. The information includes URL, username/email, password, and an "OTPAuth" column. For GitHub (the only account I've enabled native TOTP for while the feature is still in beta) the entry in that column looks like this:

> otpauth://totp/github.com:<username>?secret=<secret>&issuer=github.com&algorithm=SHA1&digits=6&period=30

So I'm not sure if that would be directly importable to another service, but at the very least you get the secret and so could transfer the data account-by-account if you had to.

given Apple's new spying stance I'm not sure I want to allow the to store my passwords
May not make a difference if you don’t take Apple at their word but iCloud Keychain is among the services/data encrypted end-to-end[1] and there’s no exception mentioned for iCloud backup (like there is for Messages).

[1]: https://support.apple.com/en-us/HT202303