TOTP tokens on my wrist with the smartest dumb watch

> To add the secret to the watchface code, you need to convert it to hexadecimal bytes. This cryptii.com page will allow you to do that conversion. Note you’ll have to enter your TOTP secret in uppercase.

I wouldn't be comfortable entering my TOTP secret into a random web page. In Linux (Ubuntu here, probably other distributions as well) you might have the `base32` and `od` tools already installed (package 'coreutils').

Otherwise the project is awesome (just the watch is fugly :))

if you're wondering why you see a weird ⌍ symbol from time to time on the demo, it's a "small 7" because the watch ties the top and bottom segments of the first and third digits (segments A and D) together.

https://joeycastillo.github.io/Sensor-Watch-Documentation/wi...

it's really amazing how much efficiency they packed in this display. in normal use, these digits only need to display the numbers 0-5 [for the first digit, the clock only needs 0, 1, 2, but the chronometer goes up to 59:59.99], none of which need to distinguish between those segments. technically I guess the chronometer could have gone up to 69:59.99 without breaking anything though, but I guess "one hour" is sufficient? the numbers 8 and 9 also illuminate both the top and bottom segment, so it's only 7 that is an issue.

Finally, the kind of content I come to HN for. =8')

The F-91W is (I think?) the same form factor as the A158W[1], which is an absurdly good looking watch for the price. It goes with everything, stylish yet unobtrusive. I often wear it instead of more expensive watches. If you're concerned about the band snagging arm hairs, it's only done it maybe twice in a year, way fewer than other economy metal bands.

If you prefer a "smoky" alternative, the A168WGG[2] has a gunmetal gray tint to the band, the face is blacked out with clear letters, and the illuminator only lights up the letters. However, the A168 is just slightly larger than the A158, so I don't know if the internal modules fit the same (but larger means more room, so, probably?).

(while I'm nerding out on watches: my workhorse/black band watch is a GA-B2100-1AJF[3]. pretty stylish for a G-Shock, and you get a ton of features for a non-smartwatch. the bluetooth model (vs cheaper models) has more contrasting face colors/tones so it works with more outfits.)

[1] https://www.amazon.com/Casio-A158WA-1-Water-Resistant-Digita... [2] https://www.amazon.com/dp/B08195YQLQ/ [3] https://www.amazon.com/dp/B09YG8F41Y/

Love this project, use it literally every day.

Not too long ago I implemented a new interface for defining the TOTP codes from within the source code. Unfortunately that work has invalidated the instructions in this article. It works like this now:

  static totp_t credentials[] = {
    CREDENTIAL(2F, "JBSWY3DPEHPK3PXP", SHA1, 30),
    CREDENTIAL(AC, "JBSWY3DPEHPK3PXP", SHA1, 30),
  };

https://github.com/joeycastillo/Sensor-Watch/blob/main/movem...

I also added user calibration to the pulsometer in order to allow it to be used as an asthmometer. It has already helped save lives.

It's also got calibration and thermal compensation features which enhance the watch's accuracy to about 10 seconds per year.

It's got a growing community. A lot of people have showed up to hack on the firmware. Recently someone made an endless runner game for the watch:

https://github.com/joeycastillo/Sensor-Watch/pull/419

The maintainers are really nice people too.

If you're looking for a great open source project to sink some time into, this is it.

Having to recompile and reflash your wristwatch is probably going to limit the number of things you use TOTP for.

This is awesome. I've always wished someone made something like this for one of Casio's calculator watches

If only I could get this to work with SecurID tokens!

Wow this is really interesting, I work at Nixon and would love to get something like this going on a Nixon digital and/or would possibly be able to get a few free watches if the author wanted to do a similar write up.

why cant i get this on my smartest smart watch?

Makes me want to go back to the old casio

I love this, and have thought of doing the same with a dumb smartwatch but... is it good opsec to have top so visible/available? What about losing the watch or getting stolen?

Looks like the WASM emulator does not emulate the classic Casio easter egg, or was I holding it wrong?

dang, this is so cool

It's time to stop using TOTP, it's vulnerable to AitM phishing. Use FIDO2 hardware keys or passkeys instead.

I used totp first time yesterday on GitHub and I don't understand it's point. I had to install otpclient app (from Ubuntu repository) where I typed 4 strings and it spit out one number which I typed back to GitHub. Attacker could do this as well, so the only thing totp does is to prove I can read and write. What am I missing here?