2FA OTP app using the Titan Secure Element?

missing-root

There are currently a few good OTP apps, but all use software. They are probably very fine, especially on Android, and I am not an expert, but I suppose having such apps use the secure element could completely remove the need for Passkeys, which are pricey, limited and often without usb-c or NFC.

Also, using your phone as a passkey over USB could be nice, I think the app OneMoreSecret does this?

mmmm

missing-root A little off topic, but you can use passkeys without any hardware. It has to be supported by the OS and your password manager. It’s easy to create a passkey login on iOS using Strongbox (a Keepass client), for example.

I wanted to mention it as you seem to imply that they are hardware devices only.

https://www.tomsguide.com/news/what-are-passkeys

boldsuck

missing-root but I suppose having such apps use the secure element could completely remove the need for Passkeys

I'm not a security expert, just a few thoughts:

Then user (OTP) apps must be able to write to the Titan chip. (AFAIK, only root can do this.)
Passkeys = WebAuthn, but with your keys in a cloud. (Strangers have your keys.)

For most sites, 2FA/MFA activation works like this:
(With 2FA there is no option like password reset! That's why a backup is always necessary).

Enable TOTP (timestamp changes every 30 seconds)
Generate recovery-codes. Which you have to save safely.
Then you can add U2F and or WebAuthn/FIDO2 devices.

The Pixel Titan Security Key is a FIDO-compliant security token as Yubikey, Onlykey, Nitrokey, Solokey.
Onlykey & Nitrokey can also serve as a hardware TOTP key.

Maybe interesting:
passkeys-what-the-heck-and-why
webauthn-vs-passkeys
Yubico Developers

p338k

OTP still relies on a shared secret and is still susceptible to phishing even when stored with a secure element.

Unless the services allow enrolling with multiple OTP secrets, using the secure element causes a single point of failure for 2FA.

de0u

boldsuck Onlykey & Nitrokey can also serve as a hardware TOTP key.

Well, sort of. Devices without a constantly-running battery-backed clock (or a network connection to contact time servers) must be told the current time for a TOTP challenge to work. If there is an app installed on your laptop which intermediates, or if you are willing for the manufacturer to track your authentications, TOTP is possible, see for example https://docs.onlykey.io/usersguide.html#google-authenticator-otg

Personally I would classify that more as "assisted TOTP" than as "actual TOTP".

boldsuck

de0u If there is an app installed on your laptop which intermediates

Yes an GUI app or CLI uses udev rules

SUBSYSTEMS=="usb", ATTRS{idVendor}=="1d50", ATTRS{idProduct}=="60fc", MODE:="0660", GROUP:="onlykey", RUN+="/usr/local/bin/onlykey-cli settime"
KERNEL=="ttyACM*", ATTRS{idVendor}=="1d50", ATTRS{idProduct}=="60fc", MODE:="0660", GROUP:="onlykey", RUN+="/usr/local/bin/onlykey-cli settime"

If you want to use the Onlykey on another computer without an app, you can use the alternative On-The-Go:

de0u
TOTP is possible, see for example https://docs.onlykey.io/usersguide.html#google-authenticator-otg

I only use TOTP on the key for sites that still cannot support U2F and or WebAuthn/FIDO2.