TOTP tokens on my wrist with the smartest dumb watch

> To add the secret to the watchface code, you need to convert it to hexadecimal bytes. This cryptii.com page will allow you to do that conversion. Note you’ll have to enter your TOTP secret in uppercase.

I wouldn't be comfortable entering my TOTP secret into a random web page. In Linux (Ubuntu here, probably other distributions as well) you might have the `base32` and `od` tools already installed (package 'coreutils').

Otherwise the project is awesome (just the watch is fugly :))

This is why I keep uMatrix around still

https://i.imgur.com/9MYqLvj.png

I can quickly disable XHR to confirm websites don't do anything server-side when I don't expect them to.

You'd really need to block fetch(), websockets, WebRTC, all external images/stylesheets/scripts added to the DOM later, and service workers (to prevent the upload from just being deferred). It's not easy to make sure a web page can't phone home.