TOTP tokens on my wrist with the smartest dumb watch

I love this, and have thought of doing the same with a dumb smartwatch but... is it good opsec to have top so visible/available? What about losing the watch or getting stolen?

Unless the owner walks around proclaiming, “This is my second factor”, a casual observer is just going to think it is a broken watch.

Eh, I keep TOTP codes on my Pebble and am fine with it, they are labeled in such a way that doesn't make it obvious what services they're for.

There's basically no lock mechanism or security on a Pebble, but it's just a second factor.

If you have my randomly generated password, have done your intel to know I might have the TOTP on my wrist, and can physically steal my watch, you've got me beat and I'm okay with that for the convenience it provides.

Also the firmware supports multiple faces. The default face can just be the time

This is why you create a blog post and share it with the world /s

All security is a balance if the threat risk and the potential loss. I love that you have a mix that works for you while staying reasonable about it.

We all have terrible, terrible tumbler locks on our doors because they are good enough to stop the extremely casual attempts but anywhere with unbarred windows is one rock from "unlocked" and we're generally fine with this for 99% of things.

Security film is another option for windows.

Early totp devices were designed to look like pocket calculators when these things were less well known. But you are supposed to reset the key if you lose the device.

What's the threat model here? An attacker is going to read this person's blog post, track them down in real life, and steal their watch to get access to their github account? That seems...unlikely.

Less obvious than a ubikey though right?

"...so he hid it, in the one place he knew he could hide something..."