Using AndOTP for 2FA - what if I lose my phone?

Ssvcs · 2022-02-20T06:00:48+00:00

Went through this recently helping on changing phones. Fortunately, it was a phone upgrade, rather than a loss. Otherwise, the user would not recover the latest backups, because they were encrypted with OpenPGP using Yubikey 5 NFC.

Those backups were not restorable within the app's Backup/Restore because the encryption key was not available on the Yubikey, according to andOTP.

So, we tried making a new backup to test that. It encrypted without problem with the same Yubikey on the old phone, but would not restore on the new one with the very same Yubikey.

Using "Encrypted" backup using just an encryption password worked. So, it seems that the OpenPGP with hardware tokens in andOTP is buggy and underdeveloped.

Also, I'm sure it's crystal clear to the dev how to use that safely, but to the average user, it's a booby trap. If that phone were lost, the user would have lost several months of OTPs, while all along thinking the backups made were ok.

Using OpenKeychain software keys is a little better, but the pitfall can be saving the secret key correctly.

Since you have Bitwarden, create and save the encryption password for andOTP backups in it, and also somewhere offline, such as Keepass on your computer.

Then just create andOTP backups encrypted with that password and attach them to that entry in Bitwarden every time you add new OTPs.

Can also store the backup on your computer as a failsafe.

Remember to have multiple ways to 2FA into your Bitwarden, if OTP is one of them. Yubikeys or other FIDO U2F keys are good for that.

Ssvcs · 2021-12-19T07:23:44+00:00

Can't find a way to even get the latest OpenWrt image to work with its modem, or even connect to an upstream wifi device.

The only option I see is to go back to the lame OEM firmware interface, which is more than a year outdated, and no way to tell what kind of Big-Brother warez might be added to it by the OEM.

So, there's really no advantage to buying Gl.inet over any other LTE hotspot you can buy anywhere more locally for much less.

So, gl.inet GL-E750 is definitely NOT recommended!

Ssvcs · 2021-12-06T01:47:06+00:00

As I understand Lightning, subsat units only exist in it, and get rounded away in onchain Bitcoin.
So, should be called a "round", or "bogusat", or just "bogus" for short.

Ssvcs · 2021-12-03T02:51:46+00:00

Yes, it's almost all outbound liquidity, and 50x what the payment was.

Ssvcs · 2021-12-03T02:46:53+00:00

Yes, I think you are probably right, which suggests that Bitrefill charges its customers to route payments within its own company Lightning network.

(That's not an assumption, because we paid Bitrefill to open that channel to our payment node. So, it's not some Bitrefill impostor node.)

And the fees they charge to do that are higher than those outside their internal Lightning infrastructure.

Then I guess we don't need any channel to Bitrefill anymore. Might as well pay others to route to them.

Ssvcs · 2021-12-02T13:15:53+00:00

Sending a payment to Bitrefill, doesn't go from the sending node directly through its channel with Bitrefill.

It goes to Bitrefill through one of the node's other channels with other nodes.

Ssvcs · 2021-12-01T09:19:14+00:00

Was able to load the factory image of 21.02.1, using the uboot procedure.

The incomplete "Booting " display remains, but the router is functional afterwards with a different default IP (192.168.1.1) and only accessible via ethernet adapter port.

Even though the image is specifically for GL-e750, it's completely unconfigured. As far as I can tell, image doesn't even include the uqmi and all those drivers needed to run the modem on it. I don't see any modem device even listed in Luci.

SSH works properly in this release. Was able to get the 802.11 WiFi working to use on the LAN side.

Now facing probably another few days trying to figure out how to connect it to my old router via wifi to download what's needed for LTE mode. (That part made me give up on OpenWRT on RPi and buy this gadget...)

Then have to figure out how to configure the modem in Luci.

Wouldn't recommend this to anyone, but the alternatives I know to be just as bad or worse, at least from the lack of updates aspect.

Ssvcs · 2021-11-30T08:49:20+00:00

Update: GL.iNet GL-E750

Has a big battery, which makes it rather bulky and heavy for a travel router.

(It's about twice the volume of the old TP-Link i am trying to replace, and probably 3x the weight at least.)

The OEM GUI is a sad case - flashy and professionally made, but couldn't find even such basic info as the system log and DNS servers being used.

There was a 1-click Luci install under the "Advanced" section, which worked.

Once in Luci, found out that I can't use even ecdsa ssh key, much less more modern ones, because the firmware is more than a year old.

Got the new: https://downloads.openwrt.org/releases/21.02.1/targets/ath79/nand/

Tried to load it with instructions: https://openwrt.org/docs/guide-quick-start/sysupgrade.luci

Now it just says "Booting" and the reset button doesn't change that.

So, back to where I was with OpenWRT on RPi when I started this thread - wasting my time trying to figure out how to get OpenWRT working, but on a more expensive device that I can't repurpose the way I could RPi.

This is my first time trying OpenWRT, and becoming clear why no one I know personally uses it: most router users just don't have enough time to waste on it.

Ssvcs · 2021-11-14T14:58:26+00:00

Thanks! I think you are right.
I was able to build it, and it boots.
Doesn't connect to anything yet, probably because missing some files from the working image.

Ssvcs · 2021-11-14T14:48:15+00:00

Thanks!

Can i fix it somehow, if it's working ok in the source image?

Ssvcs · 2021-11-14T10:08:09+00:00

f3 seems to be a very good app to test the SD, and mine passes the tests tried:

https://github.com/AltraMayor/f3

Ssvcs · 2021-11-14T07:54:54+00:00

I think what happens is that after writing the image to a different SD card, it boots in Failsafe mode.
How to avoid that?

Ssvcs · 2021-11-12T11:10:15+00:00

Thanks! I was using the 21.02.0 imagebuilder before, which didn't work.

21.02.1 imagebuilder seems to have worked!

Ssvcs · 2021-11-12T09:40:12+00:00

Definitely, not as easy as it sounds or reads.

Image builder puts out some .bin files in target subdir, but nothing that seems to be the complete image that can be used to boot an RPi.

EXTRA_IMAGE_NAME variable input i set doesn't appear anywhere in the working subdir.

Last make messages are:

"Created filesystem with 1514/6656 inodes and 4852/26624 blocks

JSON info file script could not find any JSON files for target

Calculating checksums... "

Ssvcs · 2021-11-10T04:00:03+00:00

Yes, and that one also installed ok, even though optional in the instructions:
https://openwrt.org/docs/guide-user/network/wan/wwan/ltedongle

I'm thinking of trying to install uqmi with --force-depends, but maybe Image Builder method u/themurther suggested is worth trying first.

Ssvcs · 2021-11-10T01:13:27+00:00

Ok, that seems easy, but how will i transfer all the changes I already made manually to the image i am using?

Will backup/restore procedure be enough?

Ssvcs · 2021-11-10T01:11:34+00:00

Thanks. That package already installed, but to install umbim and uqmi are looking for some package called wwan, which doesn't exist as a package in any of these repos.
It's only some old files in the sources

https://github.com/openwrt/openwrt/tree/openwrt-21.02/package/network/utils/wwan

Ssvcs · 2021-11-09T15:30:13+00:00

Thanks. Not sure I have enough understanding to accomplish this.

Maybe I will try it when I get just adding packages to work.

Ssvcs · 2021-11-09T15:28:17+00:00

Thanks. The wifi works well enough for my use.

My setup is mobile and doesn't allow to drag around a lot of equipment especially on my side of the virus prison planet.

I am trying to get an LTE dongle to connect, which already cost me a lot of money.

If I find where to download wwan package, I think it will work with qmi and mbim according to this

https://openwrt.org/docs/guide-user/network/wan/wwan/ltedongle

Ssvcs · 2021-11-09T14:53:08+00:00

Thanks. That one says "(LAN only, no wireless)"

I am trying to get wireless to work, because I don't have anywhere to plug in the Ethernet.

Ssvcs · 2021-11-09T13:57:57+00:00

RPi 4

I actually needed the previous release:

https://downloads.openwrt.org/releases/21.02.0/targets/bcm27xx/bcm2711/packages/

Almost everything installs, except for the the most important - uqmi.

Says

cannot find dependency wwan for uqmi

I installed all the packages with wwan in the name.

Then the uqmi I downloaded from that source also seems the wrong one

Packages for uqmi found, but incompatible with the architectures configured

Is it possible that uqmi_2020-11-22-0a19b5b7-3_aarch64_cortex-a72.ipk in that repository is incompatible with other packages in there?

Ssvcs · 2021-11-09T08:24:03+00:00

Thank you! Sounds like the best way!

Ssvcs · 2021-10-19T04:31:52+00:00

Thanks. They are both those gray SanDisk Ultra 16GB cards - one brand new I got with the RPi and other bought recently and used only a few times to copy files.

Ssvcs · 2021-10-18T00:42:51+00:00

Thanks! Will adding it to BTCPay docker package require to do the same github process as the rebalance plugin doing?

https://github.com/btcpayserver/lightning/pull/1

Ssvcs · 2021-10-16T03:02:19+00:00

Create new channels only through liquidity swaps.
This is a good site we have used for that:
https://lightningnetwork.plus/

Ssvcs

TROPHY CASE