4 ms·

Can anyone ELI5? It seems that I will requires either SMS, a mobile app, or USB dongle. I'm not happy about any of these options. I'm not going to give away my

Can anyone ELI5? It seems that I will requires either SMS, a mobile app, or USB dongle. I'm not happy about any of these options. I'm not going to give away my phone number, I don't have a smartphone (I have a Nexus from 2012 though), and I don't want to fork out on dongles. Someone mentioned that keepassx being able to do it, but I'm a bit hazy on that. I've registered for a gitlab account just now, and I'll be messing around with that for awhile to see if I like it. If it proves tolerable, I'll probably be yanking the plug on github.

jwilk 4y ago
TOTP is one of the supported 2FA method. There's a lot of TOTP implementations that don't require having a separate device. And if you're not happy with any of them, this is such a simple protocol, you can write your own in one evening.
- blippage 4y ago
  So, my understanding so far is that Github (or anyone, in general) will provide a private key consisting of 24 alphanum chars. Github also has a copy of the key. To authenticate, a password is generated based on the private key, which acts as a seed. That seed is combined with a timestamp in order to generate a password, which has an expiry time of about 1 minute. The algorithm that generates the password is a standard one, so once you know the algorithm, you can generate valid passwords. Linux provides "oathtool", which is suitable for such a purpose. Is my understanding correct on this?
  - jwilk 4y ago
    > private key It's a "shared secret". ("private key" implies only one party knows it.) > 24 alphanum chars Hmm, https://datatracker.ietf.org/doc/html/rfc4226#section-4 https://datatracker.ietf.org/doc/html/rfc4226#section-4 says the key "MUST be at least 128 bits", meaning at least 26 (base-32) chars. My current TOTP secret (generated in 2018) for GitHub is only 20 chars. :-/ > Is my understanding correct on this? Yes.
blippage 4y ago
So, what happened to openid? I take it that it's no longer a thing.

jwilk 4y ago

TOTP is one of the supported 2FA method. There's a lot of TOTP implementations that don't require having a separate device. And if you're not happy with any of them, this is such a simple protocol, you can write your own in one evening.

blippage 4y ago
So, my understanding so far is that Github (or anyone, in general) will provide a private key consisting of 24 alphanum chars. Github also has a copy of the key. To authenticate, a password is generated based on the private key, which acts as a seed. That seed is combined with a timestamp in order to generate a password, which has an expiry time of about 1 minute. The algorithm that generates the password is a standard one, so once you know the algorithm, you can generate valid passwords. Linux provides "oathtool", which is suitable for such a purpose. Is my understanding correct on this?
- jwilk 4y ago
  > private key It's a "shared secret". ("private key" implies only one party knows it.) > 24 alphanum chars Hmm, https://datatracker.ietf.org/doc/html/rfc4226#section-4 https://datatracker.ietf.org/doc/html/rfc4226#section-4 says the key "MUST be at least 128 bits", meaning at least 26 (base-32) chars. My current TOTP secret (generated in 2018) for GitHub is only 20 chars. :-/ > Is my understanding correct on this? Yes.

blippage 4y ago

So, what happened to openid? I take it that it's no longer a thing.