The goal:
Make TOTP accessible for a dumb phone
The why:
I don't intend to make a 'safer' system, nor do I want things to be more convenient. I just don't like to be forced to always have a smart phone on me - because it distracts and tracks me. So it would be a solution to TOTP not working on dumb phones.
The method:
- Have a raspberry pi with a SIM card
- Pi has local TOTP service running
- When it receives an SMS with the title of a TOTP entry
- Checks phone number & optional pin
- Wait for the TOTP to reset and send a code which will be available for the next 30 seconds, it could maybe send the next code as well already, just in case the carrier network is slow
- On phone you receive TOTP code as a text back
Considerations:
- SMS is encoded and not encrypted, which means it's by definition not too safe
- It is likely there will be passive logging done by malicious actors
- This is very vulnerable to SS7 or SIM swap attacks
- To me it seems at least as safe as SMS verification, still used by many login providers
I'm probably not going to do this due to the security considerations, but I felt it was interesting to think about and wanted to hear your thoughts.
Making TOTP accessible for dumb phone - brain dump
- Targa
- Posts: 6
- https://pl.pinterest.com/kuchnie_na_wymiar_warszawa/
- Joined: Wed Jul 09, 2025 2:28 pm
- Contact:
- CitricScion
- Posts: 122
- Joined: Wed Oct 16, 2024 5:37 pm
Re: Making TOTP accessible for dumb phone - brain dump
It seems to me like this is at least as secure as SMS 2FA codes, but I would recommend moving to an authenticator if you can. I don't think that lines up with what you're trying to do. Maybe you can get a cheap Pixel or iPhone that's still supported and use that only for things like this?