We understand not everyone has a smart phone to use for one-time token generation.  Here we provide a few suggestions for alternatives.  We have performed minor testing on several desktop applications to ensure they work with CCR's authentication systems; however, we are unable to provide detailed documentation or troubleshooting if they don't.  


Ultimately, the ideal and most flexible option for one-time token generation is a smart phone app that is biometrically secured to ensure you're the only one who can access it.  The second best option is a programmable hardware security key.



Programmable Hardware Key


There are many programmable hardware security keys on the market including Yubico Yubikeys, Google Titan security keys, and others recommended by UBIT.  Unfortunately, CCR is not able to integrate with the hardware security keys provided by UBIT because they are not programmable and we're unable to get the "secret" needed to join them to our authentication system.  


We have personally tested Yubikeys 4/5 but any hardware device capable of either HOTP (counter-based; RFC 4226) or TOTP (time-based; RFC 6238) should work with our systems.  Hardware security keys are not provided by CCR.  CCR nor UB is able to reimburse you for the cost of a hardware security key.  


The nice thing about the Yubikey is that you can use it with UBIT's Duo service as well.  For setup info, please visit their website.  With UB's systems you can add multiple devices so this will work even if you already have a UBIT supplied hardware token.


Please contact CCR Help for details on how to configure your hardware key.  We will need you to step through a few things and provide us a code that we apply to your account.



Desktop Applications


There are many desktop applications available for the various operating systems.  Please perform a search using your preferred search engine to find a one time token generation application for whatever operating system you're running.


To use one of these desktop apps, when you configure your CCR account with two factor authentication you will not be able to scan the QR code, as described in the instructions.  Instead, when the QR code is displayed, click on the "Show URI" link:



Copy the string of characters after "SECRET:" ending at, but not including, the &:



Then paste this string into your application's section for the "secret" - this varies by application.  Once configured successfully, your app will generate a new 6 digit one-time token every 30 seconds that you can use to login to your CCR account.



You could, in theory, install a desktop application on multiple computers and add a new token to your CCR account for each one: