3 ms·
There’s even a program called oathtool which you can use to generate TOTP and HOTP (counter-based and much more prone to skew) codes. You just need the random s
by loloquwowndueo 5y ago
There’s even a program called oathtool which you can use to generate TOTP and HOTP (counter-based and much more prone to skew) codes. You just need the random seed that’s generated when you create a device. I’m not sure how easy it is to extract from the qrcode that web services generate, though. Some identity providers will show the raw random seed.
- Jtsummers 5y agohttps://github.com/google/google-authenticator/wiki/Key-Uri-Format https://github.com/google/google-authenticator/wiki/Key-Uri-... That's the format that gets encoded into the QR code. If you can decode the QR code you can get the secret key easily.
- jmcphers 5y agoIt's pretty easy to extract! zbarimg -q -raw <png> will do it. http://manpages.ubuntu.com/manpages/bionic/man1/zbarimg.1.html http://manpages.ubuntu.com/manpages/bionic/man1/zbarimg.1.ht...
- hannob 5y agoAFAIR there isn't much to "extract", you simply use any application that can decode the QR code and you get the key which is encoded as a sequence of letters and numbers.
- composer 5y agooathtool -w1 --base32 --totp $secret Add a space before the command depending on your shell. Some shells will keep your secret out of history logs.