1

Looking for a small, dedicated device to perform the same function as an authenticator token app. Ideally, open source with the ability to select and display tokens without connecting to anything.

Think traditional RSA hardware token, only with the ability to add other tokens and flip through them.

(I don't see a related tag for anything like this, feel free to edit)

1 Answer 1

1

The Molto-1 by Token2 is a programmable, multi profile hardware token. I own one of those for a few months now and use it on a daily basis.

The Molto-2 supports 10 different profiles, 6 or 8 digit codes and SHA-1 and SHA-256 hash algorithms. Google Authenticator uses 6 digit codes with SHA-1, so the Molto-1 is fully compatible.

Programming happens with an Android app over NFC, so be sure to use a smartphone you trust. Alternatively the Molto-1i supports iOS. RTC resynchronisation also happens with the app. The app itself has pretty rough edges, but you can figure out how to use it.

One downside is the non-replaceable battery. It is supposed to last 4-5 years, and it has a battery indicator warning you early enough when it's running low.

I just realized they have a new multi-profile hardware token, the Molto-2. It is USB-programmable and features a bigger display for presenting QR codes, as well as USB HID emulation for automatic entry of TOTP codes on a computer.

1
  • Picked up a Molto-2 and got it configured today. Great device, highly recommend. Be sure that your computer clock is synced correctly or you will generate the wrong OTP. code. Recommend using an authenticator app on a smart phone to ensure the codes match. You can cancel the config to generate a new QR after if you are paranoid like me. Some online QR codes don't scan correctly in the Molto-2 program. If that happens, just use a smartphone QR reader to display the code and hand jam into the Molto-2 program.
    – sadtank
    Commented Feb 13, 2021 at 22:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.