How do I set up more than one application?

I don't have a smartphone that can run any of the compatible apps, so it looks like I have to use a browser plugin.

That kind of defeats the point of it being "two factor" authentication (something you know, like a password + something you have, like a phone).

Are you able to use SMS (the Twilio integration)?

I disagree about it defeating the point, in general. Whether the thing you have is your phone or a computer, it's still a second factor.

I guess it depends whether the application is tied to the computer, or if it's available on the cloud and is thus another 'something you know'.

To answer the question:
There is no option for users to find out their seed after finishing the setup. The only way to do it is to write it down somewhere during the setup and use it on your other computer's TOTP applications.
Yes, resetting the app will overwrite the previous seed, so applications using the older seed will not be able to authenticate you.

I guess the question is whether we want the seed to be viewable the same way one can view their unused recovery codes. I personally do not think it's worth the risk (there is no clear sign of someone stealing a seed, while with TOTP reset or recovery code stealing it's pretty obvious when a theft occurs).

Viewing existing (or generating new) recovery codes is secured behind password reentry so I think viewing TOTP seed would be OK to do in the same way. @banviktor can you elaborate on "there is no clear sign of someone stealing a seed" ?

I closed #2537652: Allow multiple TFA registrations per account also since it's very similar to this issue.

It's probably just nitpicking, but TOTP lets you log in by providing something you have. In a paranoid world it's nice to have the seed locked in some safe place where no one can get their hands on it, not even yourself (if it's well encrypted). If the seed can be copied afterwards by providing a password or anything, the user that got "attacked" won't know that someone is able to access their account.
Mean coworker, knows the password already of their target and waits for them to leave their desk. Goes there, copies TOTP seed by providing password or TOTP code (they might have left their phone on the desk), deletes e-mail notification about the event. Target has no idea that their account is now compromised. While with a TOTP reconfiguration they would be able to see clearly that they can't log in.

But that's some extreme paranoia right there.

So on a second thought, with an e-mail notification, watchdog event, password or TOTP code verification this can be considered safe, people just shouldn't leave their TOTP devices lying around people they don't trust.

@banviktor: paranoia is fine, people with TFA have more paranoia (or higher standards) anyway. Requiring the password *and* TOTP code again to get the seed again seems kind of reasonable. You can log to watchdog, although the user in question wouldn't be able to see that. Sending an email seems over the top.

Ideally there'd be a way to disallow this (viewing the seed again) entirely in configuration/permissions.

1. For security reasons, should never send seeds by email nor log the seeds to watchdog(!)...

2. IMO it would be nice to have extra permission to choose which - if any - roles that may request to see the seeds.

3. Process:
The user initiates the process of viewing his/her seed by clicking on a link "somewhere". That triggers the process of sending a one-time link to the user's email account. Upon clicking (confirming) that link, the user is prompted to provide BOTH the current password AND then (after verifying the password) also prompted for a new, fresh TOTP code.

4. The seed view should ONLY be served over SSL...

5. Each step of this process should both be logged to watchdog AND sent as info emails to the user account in question (in case of an attack/session hijack/or the like, but NOT including the seed itself.

+1 for #9.