Keeping online accounts secure is more important than ever, especially with breaches occurring all the time. Using a password manager is an important step, but if you want to take your security to the next level, it’s worth looking at secure hardware devices like the TOTPVault. This fully open-source project stores TOTP secrets and generates codes with them for 2-factor authentication (2FA), an extremely important security feature that prevents attackers from accessing accounts even with a breached password.
Separating the TOTP secrets from a general-purpose, online device like your smartphone significantly decreases the likelihood of your accounts being breached. Moving TOTP away from password managers is also important; while convenient, storing passwords and TOTP secrets in the same database degrades the security model provided for by 2FA.
The TOTPVault stores encrypted TOTP secrets on a RISC-V microcontroller, an ESP32-C3, and a different MCU handles the USB interface, separating the cryptographic processes from the data access methods. TOTP data are encrypted with AES256, and the decryption key is derived from a vault password using PBKDF2. JTAG has been permanently disabled, with eFuses set to prevent accessing the data inside the MCU. The WiFi/Bluetooth stack has been completely disabled, and there is no antenna on-board.
The project’s source code is fully available and therefore auditable; you can also build the firmware and flash it yourself to ensure the running code is exactly what you expect, reducing the amount you need to trust the seller. The ESP32-C3 was chosen because it has excellent hardware crypto support, good support for Rust, and it has been PSA-L1 certified. So if you want to take an easy step to increase your account security, especially if you work in a high-risk job like journalism, give the TOTPVault a look!
source https://blog.tindie.com/2026/07/secure-totp-storage-usage/
No comments:
Post a Comment