[HN Gopher] A 2FA app that tells you when you get `314159` (2024)
___________________________________________________________________
A 2FA app that tells you when you get `314159` (2024)
Author : jakey_bakey
Score : 180 points
Date : 2025-03-14 16:00 UTC (7 hours ago)
(HTM) web link (blog.jacobstechtavern.com)
(TXT) w3m dump (blog.jacobstechtavern.com)
| mmsc wrote:
| Dubs and I upvote.
|
| >Like all recovered edgelords who came of age in the early 2010s,
| I somewhat miss the heyday of image-boards like 4chan. They were
| the final bastion of the wild-west early internet before the
| nazis ruined everything.
|
| Extremely true. I don't know anywhere like those times these
| days. Where do the young people/trolls hang out and push to the
| edge of acceptance these days? Or is the culture of "getting
| right to the edge of getting banned but not crossing the line for
| lulz" and "act in a way nobody knows whether you're actually
| trolling or not" dead?
| jakey_bakey wrote:
| The 4channification of the mainstream is quite sad - it took
| all the unpleasant sociopathic politics and none of the fun!
|
| > act in a way nobody knows whether you're actually trolling or
| not
|
| This is basically how I market my blog :)
| pests wrote:
| Find a lot of it on discord.
| sanex wrote:
| I think a part of what happened has to do with >"act in a way
| nobody knows whether you're actually trolling or not"
|
| Some people were joking and some weren't, or were just too dim
| to understand that it was a joke, and then when they all showed
| up in Charlottesville to march. They were mostly serious except
| for that one poor guy who still thought it was a meme and ran
| away.
| jampa wrote:
| There was even an old 4chan joke for this:
|
| "Any community that gets its laughs by pretending to be
| idiots will eventually be flooded by actual idiots who
| mistakenly believe that they're in good company." -Rene
| Descartes
| mmsc wrote:
| The amusing thing being that the original source of this is
| hn, not 4chan [1]. deserves a spot on
| https://news.ycombinator.com/highlights imo.
|
| [1]: https://news.ycombinator.com/item?id=1012082
| stavros wrote:
| My god, DarkShikari... I haven't heard that name in a
| decade.
| hooverd wrote:
| Eventually, the ironic becomes unironic. If you're pretending
| to be an idiot, eventually you'll find yourself surrounded by
| actual idiots. Or bigots.
| gbalduzzi wrote:
| Instagram reels.
|
| There is a ton of content with dark jokes, black humor, very
| provocative content and even "nazi" memes and people send it to
| each other to laugh about it.
|
| Those reels usually have very few likes / comments but A TON of
| sends. I personally am on multiple group chats where we only
| send each other those kind of memes.
|
| The thing is, instagram being a huge echo chamber. Before you
| have no idea those exists, and once you are in you see a ton of
| those
| chatmasta wrote:
| The echo chamber on Instagram is deep. Even when there are a
| ton of comments, they're sorted beginning with the most
| "relevant" (i.e. worldview affirming). So if you're viewing a
| controversial video, you'll see comments echoing your own
| beliefs, and others will see the opposite. You'll both move
| onto the next video thinking "wow, everyone agrees with me!"
|
| I deleted instagram last year and haven't reinstalled it.
| Those reels are so addicting. I'm glad I never installed
| TikTok because I imagine it's just as bad. I still suffer
| from YouTube Shorts but at least the mobile web UI is janky
| enough to eventually push me out of its trance.
| wongarsu wrote:
| TikTok has the same issue. Two people can see the same
| video, come to opposite conclusions, and only see comments
| that agree with them.
|
| TikTok is maybe the last bad echo chamber of the big short
| video platforms: stitches encourage some sort of debate and
| expose you to snippets of opposing view points, and the
| algorithm gives you at least a chance of finding new types
| of content you also like. But it's only the least bad, it's
| still very bad. Especial once you factor in your own
| confirmation bias and the comment algorithm
| Workaccount2 wrote:
| Instagram is a special level of degeneracy. That is an app
| made for the masses. I never used tik tok, but youtube
| shorts gives me actual quality content while instagram
| feels like its gunning for a mix of reality TV, post 2005
| history channel, and animal brain fondling.
|
| Although I will admit that Instagram has their advertising
| insanely dialed in. The content is gross junk food but the
| ads I have actually clicked before.
| ivan888 wrote:
| > Dubs
|
| Not sure if anyone else noticed the item id of this comment
| does indeed end in 88?
| jakey_bakey wrote:
| Dubz get!!!
| dpedu wrote:
| Particularly ironic since it mentions nazis...
| probably_wrong wrote:
| I want to argue that there are some rose-tinted glasses at
| play. /b/ (which is what most people think of when they think
| about 4chan) has been considered "no longer good" since at
| least 2006 [1], probably earlier. And even by that time they
| were already organizing raids and causing real harm to
| communities, both online and offline.
|
| I'm not sure that it's 4chan the one who has changed but rather
| that the world got a lot more connected [2]. A 2010 edgelord
| may say "pool's closed" while a 2025 edgelord may say "it was a
| Roman salute", but the spirit behind is probably the same.
|
| [1]
| https://en.wikipedia.org/wiki/Talk:4chan/Archive_4#Death_of_...
|
| [2] https://ourworldindata.org/grapher/number-of-internet-users
| ToucanLoucan wrote:
| All of this 100%. And on a more personal level, while I had a
| grand old time as a 3edgy5me t(w)eenage boy on the early,
| "free" internet, that time has left me with numerous mental
| scars I carry with me every day.
|
| - Thanks to shock sites, for showing me things a 13 year old
| kid really should not be seeing, and I wish I meant something
| as banal as pornography. I'm still occasionally haunted by
| images I've seen to such a degree where I have to take short
| breaks at work to compose myself.
|
| - Thanks to political discussion boards, which turned
| important, real life issues and global problems that have
| genuine life or death stakes for people who weren't me into
| an alternative to sports that also let me pretend I was in
| any way intellectually superior to my peers for simply being
| willing and able to regurgitate conservative political
| propaganda that I barely comprehended.
|
| - Thanks to the entire thing, for helping me nurture a shut-
| in mentality, that other people were too much work to be
| worth it, that my peers were dumb and not worth my time, that
| they wouldn't understand me at all and so involving myself in
| school was completely pointless, ensuring I would have no
| social life or skills whatsoever when I graduated high school
| and later college. Instead you gave me an entire other world
| of similarly uninformed, loud assholes to live in that would
| completely dissolve by the year 2009, leaving me 20 years old
| with no idea who the fuck I was, or what I believed in, ripe
| for recruitment into reactionary politics that would make me
| an insufferable douchebag for the next 10 years or so until I
| managed to pull my head out of my ass.
| xandrius wrote:
| So well put. This should be posted every time someone is
| nostalgic of those times.
|
| I'm not pro-walled garden, all is dandy and barbie but
| there is an opposite extreme.
|
| For me the most fun time as a teenager was role-playing on
| forums: free, fun and harmless.
| rpmisms wrote:
| > I'm still occasionally haunted by images I've seen to
| such a degree where I have to take short breaks at work to
| compose myself.
|
| This is PTSD. Get checked out.
| jasonjayr wrote:
| You know the meme. /b/ was never good.
| mmsc wrote:
| As the other poster pointed out, /b/ was never good;).
|
| But:
|
| >A 2010 edgelord may say "pool's closed" while a 2025
| edgelord may say "it was a Roman salute", but the spirit
| behind is probably the same.
|
| I think I disagree. I don't think "pool's closed" was ever
| boosted into the mainstream, nor was it legitimized across
| truly fascist or racist communities; it was an internet meme
| for internet people. "It was a roman salute" is a phrase of
| normies that likely have limited experience with computers
| and online communities; without getting into the politics, a
| certain class of people actually believe "it was a roman
| salute". "pool's closed" meant nothing outside of specific
| communities.
| Modified3019 wrote:
| "Any community that gets its laughs by pretending to be
| idiots will eventually be flooded by actual idiots who
| mistakenly believe that they're in good company."
| (https://news.ycombinator.com/item?id=1012082)
|
| Having been an early user of 4chan back in late 2003, from
| what I saw, the tone shift of nazi stuff just being edgy
| belligerence for the shock value to people saying "no really,
| this is my serious political ideology" really got traction
| somewhere around 2012-2014. Prior to that, there was still
| pushback. Much like how the idea of having a "waifu" was
| originally a derisive joke, but somehow turned into actual
| practice.
|
| This coincided with a few things, massive increase in
| internet use, raids having increased 4chans notoriety, but
| most importantly it was the timeframe when Russia prepared
| for and invaded invaded crimea, which included ramping up
| "active measures" to shift conversation with troll
| farms/propaganda. 4chan (and later, 8chan, which had a huge
| population of boomers buying into "qanon" nonsense) became an
| ideal host to try to amplify disruptive propaganda.
|
| I didn't quite notice what was going on, since by that time I
| was mostly only on select boards like /tg/ or alt chans like
| operatorchan, but the Russian influence became obvious in the
| lead up to the 2016 election.
|
| And it wasn't just nazi stuff, it was all sorts of bullshit
| like Marxism, esoteric magic and conspiracy shit that was
| being thrown around to see what stuck. And they were active
| across _every_ social media site. Though as bad as 4chan was,
| I'd argue russian presence on Facebook and twitter was
| especially harmful and far reaching. They didn't even need to
| be subtle or target groups: https://qz.com/1284222/russian-
| facebook-ads-were-barely-targ...
| Workaccount2 wrote:
| Trump being a meme is what got him off the ground. And here
| we are.
| 0x138d5 wrote:
| >around 2012
|
| "the post that killed /new/" comes to mind
| Goronmon wrote:
| Community size and reach plays a big part in this.
|
| Aside from the the whole "Am I trolling as a racist or am I a
| racist trolling?" issue, communities get away with a lot more
| when they are smaller, more insular and more hidden from the
| public. Once the community starts to bleed out beyond the
| immediate site, you start to run into issues. Not just because
| the jokes and content are spreading, but the attitudes behind
| those jokes. And those attitudes (even if they make up just a
| portion of the users) have a tendency to not be great.
|
| I think a perfect example of this would be what happened on
| Reddit with the /r/antiwork subreddit. As soon as the community
| got too large and started spilling into other areas of the
| site, the cracks started to show. Culminating with the
| interview by one of the mods (?) on Fox News I believe. All of
| a sudden a chunk of the users are questioning "Wait, this is
| who I'm siding with?" and then the only people left are the
| people who aren't bothered.
| mmsc wrote:
| Well said, and I think it extends to many communities which
| are founded on negativity of some sort: eventually people
| move on, except for those so-filled with negativity, it is
| all they have.
| bbor wrote:
| Or is the culture of "getting right to the edge of getting
| banned but not crossing the line for lulz" and "act in a way
| nobody knows whether you're actually trolling or not" dead?
|
| Yup, among the sane! If there are any bastions left, we're
| working on eradicating them. Honestly kinda baffled someone
| could type this sentence with the implication that this is a
| _good_ thing...
| mmsc wrote:
| >Yup, among the sane! If there are any bastions left, we're
| working on eradicating them
|
| The communities of trolls trolling trolls have been replaced
| by larger communities of nazis training nazis to attack and
| terrorize. Thank you for eradicating the former, paving way
| for the latter.
| square_usual wrote:
| > Where do the young people/trolls hang out and push to the
| edge of acceptance these days?
|
| Discord. It's all underground. The public internet is hostile
| to it, everyone has had to built their own spaces.
| mise_en_place wrote:
| They're still around, they just happen to be on X/Telegram.
|
| Roughly speaking they're in two camps: Groypers and BAP-
| adjacent Yarvinites. I suppose both are "Nazi" in the sense
| they are anti-intellectual and anti-egalitarian. Some are paid.
| Some do it for free.
|
| I don't see much of an equivalent on the left, maybe extreme
| far left Zizarian types or femcel/misandrists.
| Terr_ wrote:
| Thre's a very good video series that deconstructs "The Alt-
| Right playbook", with respect to how they exist between other
| communities, recruit new members, rhetorical argument, etc.
|
| https://www.youtube.com/playlist?app=desktop&list=PLJA_jUddX...
| notorandit wrote:
| And not telling when you get 271828? Racist!
| jakey_bakey wrote:
| Honestly making it configurable for birthdays would be pretty
| neat
| lxgr wrote:
| The obvious solution here is to discover an important natural
| or mathematical constant that happens to match your birthday
| in its first six digits.
| a_tyler_ wrote:
| That's a fun little Easter egg! It's always cool to see small
| details like this that add some personality to otherwise routine
| tasks. Makes me wonder what other quirky things could be hidden
| in security tools without compromising functionality.
| jakey_bakey wrote:
| The password manager that... writes very short puns!
| jonas21 wrote:
| I love Easter eggs -- but security tools are the last place I
| want them showing up.
|
| Like do you really want to entrust your TOTP secrets to a
| random app by a guy you've never met just to get some fun push
| notifications?
| hiatus wrote:
| TOTP seeds are only useful if you have the account they are
| associated with. How would the 2fa app by some random guy
| discern the identity associated with the seed?
| TZubiri wrote:
| It's not even worth the thought.
| jonas21 wrote:
| To add an item, you scan a QR code. That QR code usually
| contains the name of the service and your username. For
| example, the format of Github's QR code is:
|
| otpauth://totp/GitHub:[username]?secret=[secret]&issuer=Git
| Hub
| jakey_bakey wrote:
| Yeah this seed is what's stored on Keychain
| freehorse wrote:
| What? The same way that when you look at the 2fa codes in
| your app you know which account they are associated with.
| The qr codes people typically scan for that do not just
| contain the seed itself but metadata for the account
| associated with it like email address or account name.
| hiatus wrote:
| I had a similar concern when I used a random app for TOTP
| on my garmin watch, but was relieved when I considered
| the point I raised. To add codes to the watch you have to
| paste a seed into an app, and it couldn't be triggered
| from a QR code. I didn't realize the scan for 2fa had so
| much info.
| xp84 wrote:
| Isn't one issue the display of the codes on the lockscreen?
| If viewing notification contents there is enabled, it would
| be problematic if it popped up while you were away from
| your device to say "Your Google 2fa is 100000 right now". I
| get that the iOS default requires unlock to view the actual
| content of the notification, but still, that seems less
| than perfect from a security standpoint.
|
| Still the app is fun and I appreciate it.
| jakey_bakey wrote:
| Notifications say nothing about the account - just that
| you got this cool number on the app. And yeah you need
| the device unlocked to read the notification anyway
|
| But yeah security concerns with it are overblown, the
| more realistic concern is trusting me personally vs a
| name brand!
| beny23 wrote:
| Giving a random app your 2FA secrets? Raises eyebrow...
| jakey_bakey wrote:
| Feel free to network proxy and check I'm not being cheeky - I
| have another blog post about that ;)
| freehorse wrote:
| What if one bad actor does it not initially do that, but only
| after the app has enough users, with a random upgrade? Not
| that _you_ would do that, of course. But it makes sense that
| people are wary about where they trust their TOTPs.
|
| Some time ago people were locked out of their TOTPs because
| some guy bought their app from its creator and turned it into
| ransomware having them pay to not lose their codes.
| jakey_bakey wrote:
| Yeah that's fair to be honest, at least until my blog
| starts pulling enough money to not be worth destroying my
| reputation on a rugpull
| TZubiri wrote:
| Cute, but ultimately cute features are not compatible with a
| critical security application.
|
| If it had been developed as a feature of an existing application
| maybe it would fly (and probably even not there). But as a third
| party app, or even a third party library that needs to be added
| to the security supply chain? Not a chance for any serious
| business.
| zamadatix wrote:
| This calls me heavily towards the quoted note about halfway
| through:
|
| "Does nobody make apps for fun anymore?"
| jakey_bakey wrote:
| I feel like sometimes I'm the only person in the world not
| shipping ultraniche paywall aso slop
| mckn1ght wrote:
| This doesn't mean _every_ app has to be fun. If I want to
| have fun, I'll go play with something specifically built for
| fun. If I'm balls deep in an incident and suddenly my MDM
| security policy login TTL expires and I have to
| reauthenticate, the last thing I want to see is yet another
| interstitial with some cutesy BS to nuke my working memory.
| TZubiri wrote:
| "interstitial"
|
| Sidetrack but this is interesting wording, what do you mean
| exactly? As in some software that is accesory to other
| software? Or something that you have to access while moving
| between software?
| avianlyric wrote:
| You might want to read the quote again.
|
| > "Does nobody make apps _for_ fun anymore? "
|
| The author isn't making _a_ fun app, they're making an app
| _for_ fun. Your crazy incident doesn't really have much
| bearing on how much fun the author has writing an app.
| avidiax wrote:
| Yeah, unfortunately "Easter eggs" call into question the
| security of the software pipeline.
|
| Did PMs and other engineers review and OK this? -> Suggests a
| lack of judgement or just rubber-stamping.
|
| Did a lone engineer add this "just to be cute", and it didn't
| get caught and stopped? -> Proof that your development/release
| processes are insufficient and you are intensely vulnerable to
| insider threats.
|
| Neither is good for a security product. At a previous company
| we were explicitly told that any easter egg was an immediate
| firing. The company's products had a long history of easter
| eggs before that.
| tasuki wrote:
| > Not a chance for any serious business.
|
| Why would you think "serious business" is the target audience?
| I think "serious business" is about as far from the target
| audience as possible...
| remram wrote:
| Complete tangent: "voila" is French for "here it is", but "viola"
| is French for "raped". Careful using foreign words if you're not
| sure you can spell them.
| mog_dev wrote:
| Not exactly, its the 3rd person of passe simple
| thaumasiotes wrote:
| > "voila" is French for "here it is"
|
| I thought it was French for "look at that" (or I guess,
| literally, "look over there").
| jakey_bakey wrote:
| Scare bleu!
| tedunangst wrote:
| What if I want someone to look at my big violin?
| xandrius wrote:
| Viola also means purple/violet or the instrument. Let's try to
| be more chill about people making typos, nobody, even a fluent
| French speaker would read it as "raped". Only someone with a
| keen eye for drama and being a nuisance.
| remram wrote:
| I very much meant it as a nitpick. This is a single comment
| labeled as a tangent, how is it "drama"? Chill.
| ipaddr wrote:
| Voila - there it is
|
| Viola - musical instrument
|
| viole - raped
|
| Accents matter but not as much as different letters. Don't
| correct spelling without knowing the proper term.
| remram wrote:
| I'm literally French. I'm sorry you don't know the passe
| simple.
|
| https://la-conjugaison.nouvelobs.com/du/verbe/violer.php
| jmholla wrote:
| I think this is a bad idea and insecure. Obtaining a code needs
| to be an intentional effort and not just available to someone who
| happens to be screen surfing my phone at the right time. It's
| worse that it's on the lock screen as it seems the author does
| based on their screenshots. Lose your phone, and your passcode
| will not protect someone from using your codes.
| lxgr wrote:
| I think it's a great idea, but definitely very insecure, yes.
| Don't load your actual TOTP credentials into it, obviously.
| jakey_bakey wrote:
| To be clear, you don't see the account details in the
| notification, just the number, and can't even read it until
| unlocking the device
| neilv wrote:
| I have one of those time-based number hardware fobs, with the
| 6-digit 7-segment LCD display, which I'd guess I'd actuated less
| than 100 times, yet on one such actuation, it displayed
| 1-2-3-4-5-6.
|
| Maybe because the whole mode when using it is infosec, my snap
| first thought was about how this is highly unlikely and is
| someone messing with me.
|
| My next thought was to run to get a camera from the other room,
| regardless of whatever is going on.
|
| By the time I got back with a camera, and just barely missed
| photographing the display, I realized that someone compromising
| my airgapped self-contained hardware fob was even more unlikely
| than this number sequence coming up randomly within 100
| actuations.
|
| And, like this article points out, there are many "unlikely"
| numbers that might come up, so the chance of any of them is not
| as unlikely as it would first seem until you thought about it.
| cdelsolar wrote:
| I was driving my wife's car a few years ago when I managed to
| look down and see that the temperature was 55 degrees, and the
| odometer read 55,555. For a split second I couldn't believe my
| eyes; what are the chances?
| ipaddr wrote:
| Based on NOAA weather data, a rough estimate for the
| probability of experiencing exactly 55degF at any given time
| in temperate U.S. cities is around 2-5% on average
| neilv wrote:
| That this-can't-be-correct reaction can be useful in
| emergencies, if it gets your attention, and activates a mode
| in which you can focus and act decisively in an instant.
|
| I once was applying a spray-can anti-slip treatment to a
| bathroom floor, when I might've heard a whoosh, looked up,
| and had a thought (that I remembered afterwards as) "fire
| shouldn't be coming from that direction".
|
| From the adjacent room, there was this flash fire shooting
| across the floor at me.
|
| That got my attention, and activated an emergency mode, parts
| of which I had no recollection. I somehow leapt backwards up
| onto the tub edge in an instant. Then the floor was on fire
| and lapping at the walls of the small bathroom I was in. The
| next thing I knew, I'd leapt over the flame, into the next
| room, somehow gotten the fire extinguisher from inside a
| cabinet, and was putting out the fire. Which worked nicely.
|
| Then, I guess, as that mode was winding down, without really
| thinking about it, I put the exhausted fire extinguished back
| in its spot in the cabinet. As I went to call the fire
| department to check out that there were no lingering
| problems.
|
| (Turned out that the floor treatment application also emitted
| a highly flammable gas, which rolled across the floor, into
| the next room, until it hit the pilot light in an old nat-gas
| oven.)
|
| Now, if we had an adrenaline reaction every time we saw
| unlikely numbers, that would be a problem. But, however the
| cognitive scientists deconstruct it, I'm fond of having what
| I'll call a good emergency mode feature.
| ezekg wrote:
| > Now, if we had an adrenaline reaction every time we saw
| unlikely numbers, that would be a problem.
|
| I think there's a relatively new TV show about this,
| actually.
| ipaddr wrote:
| If you run the fob 100 times, the probability of seeing
| "123456" at least once is about 1% (1 in 100 chance).
|
| One person in every hundred
| KeplerBoy wrote:
| It's not?
|
| There's a (1**6-1)/1**6 chance of not getting it on any given
| try, so there's a ~1/10**4 chance of getting it within 100
| tries. So quite unlikely, but of course possible and bound to
| happen among millions of users.
| neilv wrote:
| I got 100 actuations has 1 chance in 10,000, which is
| unlikely, but not maybe not as unlikely as it seemed at first
| glance. 1 actuation has 1 chance in
| 1e6 1e2 actuations has 1e2 chances in 1e6 1e2
| actuations has 1 chance in 1e4
| scarlehoff wrote:
| I felt real joy reading this, thanks :)
|
| As someone starting to feel a bit of burnout I think I needed to
| read something like this.
| jakey_bakey wrote:
| This was 100% the most fun I've ever had coding anything. I was
| missing my tube stop levels of engaged
| johnisgood wrote:
| So... can I get 314159 by setting the time_step and start_time to
| a specific value? (With either hash algorithms like SHA-1 or
| SHA-512).
___________________________________________________________________
(page generated 2025-03-14 23:00 UTC)