<!DOCTYPE html><html><head><title></title><style type="text/css">p.MsoNormal,p.MsoNoSpacing{margin:0}</style></head><body><div>On Sat, Jun 18, 2022, at 17:19, Khalid Baheyeldin wrote:<br></div><blockquote type="cite" id="qt" style=""><div dir="ltr"><div>That leaves app passwords as the other practical way for a server application. How <br></div><div><div>often do these need to be refreshed? If it is also a week, then that is a big bummer <br></div><div>moment ... <br></div></div></div></blockquote><div><br></div><div>They do not expire.<br></div><div><br></div><div>They *can* be manually revoked. But otherwise they persist until you revoke them.<br></div><div><br></div><blockquote type="cite" id="qt" style=""><div dir="ltr"><div><div><br></div><div>And on the Google account level, you mentioned that TOTP works. I think I will use<br></div><div>that as my 2FA for the overall account, since I can run it on Android (FreeOTP+),<br></div><div>my laptop (oathtool), and the server (oathtool). <br></div></div></div></blockquote><div><br></div><div>I've been using andOTP on Android. Also open source, but I liked the tags and interface more. I have 62 TOTP codes, so I need some sort of organization for them. Also, this is why I also generally prefer u2f/webauthn/yubikeys (they're also harder/impossible to phish).<br></div><div><br></div><div>I import my andOTP backup into the GNOME app "Authenticator", which works okay. Unfortunately it merges when restoring a backup, so I have to delete all codes in Authenticator before importing an updated andOTP backup...<br></div><div><br></div><div id="sig91988184"><div class="signature">-- <br></div><div class="signature"><b>Chris Irwin</b><br></div><div class="signature"><br></div><div class="signature"><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">email: chris@chrisirwin.ca</span><br></div><div class="signature"><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> web: <a href="https://chrisirwin.ca">https://chrisirwin.ca</a></span><br></div></div><div><br></div></body></html>