6 ms·

Is there some Unix-ish tool to generate these TOTPs on a laptop? I don't like to keep the 2nd factor on a small mobile device that is easy to lose. So I ask abo

by distcs 4y ago

Is there some Unix-ish tool to generate these TOTPs on a laptop? I don't like to keep the 2nd factor on a small mobile device that is easy to lose. So I ask about a laptop tool. By Unix-ish I mean something that is small and does one thing well. Like pipe in a secret to it and it gives me a TOTP? Pipe in multiple secrets and it gives me multiple TOTPs? Then I don't have to remain beholden to a custom encryption format. I can encrypt my secrets with other Unix-ish tools, decrypt it, pipe it to this tool and get my TOTPs. Recommendations?

guipsp 4y ago
https://github.com/WhyNotHugo/totp-cli https://github.com/WhyNotHugo/totp-cli
tecleandor 4y ago
Several options... Not exactly the same, but if you're using Bitwarden (which is compatible with generating TOTP tokens) to manage your passwords, you can use their bitwarden-cli tool to request tokens from the cli: https://bitwarden.com/help/cli/#get https://bitwarden.com/help/cli/#get But if you want the simplest cli thing, you can probably can use this golang ( https://github.com/yitsushi/totp-cli https://github.com/yitsushi/totp-cli ) or this python ( https://github.com/WhyNotHugo/totp-cli https://github.com/WhyNotHugo/totp-cli ) implementations.
wolczek 4y ago
https://keepassxc.org https://keepassxc.org comes with keepassxc-cli
grenoire 4y ago
I just cooked up something in Python if you have it installed on your system, quite straightforward to use. If there's interest, I can prepare a compiled version. Unlike the other ones posted here, this one just takes secrets as arguments: > python -mtotp DGLTPWEUERUUDCEC SWPKQCKEWRXPCRXE 628502 674329 https://pastebin.com/apNKxMBF https://pastebin.com/apNKxMBF
- susam 4y ago
  I believe it is worth mentioning here that reading secrets from command line arguments exposes the secrets in shell history (e.g., ~/.bash_history, ~/.zsh_history, etc.), thus writing the secrets in cleartext to the filesystem. If command line auditing is enabled on a system, any secrets in command line arguments would be exposed in such audit logs too. Further, if multiple users are logged into the same system (perhaps an unlikely scenario for most people), then secrets in command line arguments would expose the secrets in the output of ps -ef too thereby exposing the secrets to other users. By the way, I have a similar script at https://github.com/susam/mintotp https://github.com/susam/mintotp but it reads secrets from the standard input (as opposed to reading from command line arguments), one secret per line, and outputs TOTP values, one per line. Most of what this script does can be done with oathtool too and there is a section titled "Alternative: OATH Toolkit" in the README that documents this in detail.
  - grenoire 4y ago
    I should indeed have mentioned that. On the other hand, this is not a concern if you do not execute the it outside your shell (e.g. in another script that reads TOTP secrets from elsewhere).
  - twalla 4y ago
    fun fact: you can teach your shell to ignore commands that begin with a space character. in bash $HISTCONTROL needs to be ignorespace or ignoreboth, in zsh you must setopt HIST_IGNORE_SPACE
  - neilv 4y ago
    > reading secrets from command line arguments exposes the secrets in shell history Yes, and process arguments (such as from command line) can also be accessible in process list data that's accessible to other processes and users. Even if the process only lives for an instant, or normally no other processes could access the data, good practice is to nevertheless keep secrets out of any process arguments.
3np 4y ago
Here's an example of how you can wrap oathtool from oath-toolkit: https://markusholtermann.eu/2018/08/simple-bash-totp-script/ https://markusholtermann.eu/2018/08/simple-bash-totp-script/ https://www.nongnu.org/oath-toolkit/ https://www.nongnu.org/oath-toolkit/
maeln 4y ago
> Is there some Unix-ish tool to generate these TOTPs on a laptop? I don't like to keep the 2nd factor on a small mobile device that is easy to lose. I know that this is not really answering your question, but most open-source TOTP apps (like andOTP and Aegis) can export all the TOTP in an encrypted file that you can save. So if you lose your main TOTP device you can restore all of them quite easily.
undume 4y ago
OATH Tookit provides console tool for generating TOTP codes: oathtool. https://www.nongnu.org/oath-toolkit/ https://www.nongnu.org/oath-toolkit/
aw1cks 4y ago
pass-otp[0] integrates into pass[1] nicely. It's about as unix-y as password/secret management comes in my eyes. Alternatively, gopass[2], which re-implements pass in golang, has this functionality built in[3]. [0] https://github.com/tadfisher/pass-otp https://github.com/tadfisher/pass-otp [1] https://www.passwordstore.org/ https://www.passwordstore.org/ [2] https://www.gopass.pw/ https://www.gopass.pw/ [3] https://github.com/gopasspw/gopass/blob/master/docs/commands/otp.md https://github.com/gopasspw/gopass/blob/master/docs/commands...
- nashashmi 4y ago
  Also need to mention totp.app It allows export import feature of keys
- tadfisher 4y ago
  Thanks for the compliment!
- pabs3 4y ago
  Also use browserpass to integrate pass with Firefox/etc: https://github.com/browserpass/ https://github.com/browserpass/
nashashmi 4y ago
Totp.app is a great web app. So you can install on your phone as well
- deleted 4y ago
  [deleted]
Amorymeltzer 4y ago
From today! https://drewdevault.com/2022/10/18/TOTP-is-easy.html https://drewdevault.com/2022/10/18/TOTP-is-easy.html
computerfriend 4y ago
You can also store them on YubiKeys, accessible on the command line with ykman.
lukeschlather 4y ago
You need a TPM 2.0 compatible CPU, but something like this sounds really excellent: https://github.com/tpm2-software/tpm2-totp https://github.com/tpm2-software/tpm2-totp This means your laptop itself would be your hardware device, the TOTP secret would be stored in the TPM and theoretically impossible to steal/copy. Of course this means you will probably want a mobile device (possibly a second laptop also) as a backup.)
- cryptonector 4y ago
  Note that tpm2-totp is specifically meant to authenticate your laptop's state (TPM PCR values) to you, not you to some third system. But you could adapt tpm2-totp for the purpose of authenticating you to other systems.
emreb 4y ago
Authy used to have a Chrome client you can run on your computer that syncronizes all your secrets.
markstos 4y ago
You are looking for a Yubikey and `ykman`. This is secure because the secret never leaves the hardware key. This is convenient because you launch a tool with a global keyboard shortcut and copy/paste the code. I use `yubikey-oath-dmenu` to allow me to quickly filter to the TOTP code I need.
adamgordonbell 4y ago
I think you want oathtool. You can also use python's pyotp.totp.now() https://earthly.dev/blog/multi-factor-auth/ https://earthly.dev/blog/multi-factor-auth/
deleted 4y ago
[deleted]
austinjp 4y ago
I use https://github.com/pcarrier/gauth https://github.com/pcarrier/gauth It relies on file permissions so is not exactly robustly secure (no idea about RAM vulnerabilities etc). As per the author, I consider my laptop the fundamental point of vulnerability. If someone else gets access to it, I'll know and I'll hit the metaphorical panic button :) Edit: I recently set up a new laptop, and copied my OTP seeds from Aegis into gauth without a hitch. Another step closer to me moving away from Authy.

by distcs 4y ago

guipsp 4y ago

https://github.com/WhyNotHugo/totp-cli https://github.com/WhyNotHugo/totp-cli

tecleandor 4y ago

Several options... Not exactly the same, but if you're using Bitwarden (which is compatible with generating TOTP tokens) to manage your passwords, you can use their bitwarden-cli tool to request tokens from the cli: https://bitwarden.com/help/cli/#get https://bitwarden.com/help/cli/#get But if you want the simplest cli thing, you can probably can use this golang ( https://github.com/yitsushi/totp-cli https://github.com/yitsushi/totp-cli ) or this python ( https://github.com/WhyNotHugo/totp-cli https://github.com/WhyNotHugo/totp-cli ) implementations.

wolczek 4y ago

https://keepassxc.org https://keepassxc.org comes with keepassxc-cli

grenoire 4y ago

I just cooked up something in Python if you have it installed on your system, quite straightforward to use. If there's interest, I can prepare a compiled version. Unlike the other ones posted here, this one just takes secrets as arguments: > python -mtotp DGLTPWEUERUUDCEC SWPKQCKEWRXPCRXE 628502 674329 https://pastebin.com/apNKxMBF https://pastebin.com/apNKxMBF

susam 4y ago
I believe it is worth mentioning here that reading secrets from command line arguments exposes the secrets in shell history (e.g., ~/.bash_history, ~/.zsh_history, etc.), thus writing the secrets in cleartext to the filesystem. If command line auditing is enabled on a system, any secrets in command line arguments would be exposed in such audit logs too. Further, if multiple users are logged into the same system (perhaps an unlikely scenario for most people), then secrets in command line arguments would expose the secrets in the output of ps -ef too thereby exposing the secrets to other users. By the way, I have a similar script at https://github.com/susam/mintotp https://github.com/susam/mintotp but it reads secrets from the standard input (as opposed to reading from command line arguments), one secret per line, and outputs TOTP values, one per line. Most of what this script does can be done with oathtool too and there is a section titled "Alternative: OATH Toolkit" in the README that documents this in detail.
- grenoire 4y ago
  I should indeed have mentioned that. On the other hand, this is not a concern if you do not execute the it outside your shell (e.g. in another script that reads TOTP secrets from elsewhere).
- twalla 4y ago
  fun fact: you can teach your shell to ignore commands that begin with a space character. in bash $HISTCONTROL needs to be ignorespace or ignoreboth, in zsh you must setopt HIST_IGNORE_SPACE
- neilv 4y ago
  > reading secrets from command line arguments exposes the secrets in shell history Yes, and process arguments (such as from command line) can also be accessible in process list data that's accessible to other processes and users. Even if the process only lives for an instant, or normally no other processes could access the data, good practice is to nevertheless keep secrets out of any process arguments.

3np 4y ago

Here's an example of how you can wrap oathtool from oath-toolkit: https://markusholtermann.eu/2018/08/simple-bash-totp-script/ https://markusholtermann.eu/2018/08/simple-bash-totp-script/ https://www.nongnu.org/oath-toolkit/ https://www.nongnu.org/oath-toolkit/

maeln 4y ago

> Is there some Unix-ish tool to generate these TOTPs on a laptop? I don't like to keep the 2nd factor on a small mobile device that is easy to lose. I know that this is not really answering your question, but most open-source TOTP apps (like andOTP and Aegis) can export all the TOTP in an encrypted file that you can save. So if you lose your main TOTP device you can restore all of them quite easily.

undume 4y ago

OATH Tookit provides console tool for generating TOTP codes: oathtool. https://www.nongnu.org/oath-toolkit/ https://www.nongnu.org/oath-toolkit/

aw1cks 4y ago

pass-otp[0] integrates into pass[1] nicely. It's about as unix-y as password/secret management comes in my eyes. Alternatively, gopass[2], which re-implements pass in golang, has this functionality built in[3]. [0] https://github.com/tadfisher/pass-otp https://github.com/tadfisher/pass-otp [1] https://www.passwordstore.org/ https://www.passwordstore.org/ [2] https://www.gopass.pw/ https://www.gopass.pw/ [3] https://github.com/gopasspw/gopass/blob/master/docs/commands/otp.md https://github.com/gopasspw/gopass/blob/master/docs/commands...

nashashmi 4y ago
Also need to mention totp.app It allows export import feature of keys
tadfisher 4y ago
Thanks for the compliment!
pabs3 4y ago
Also use browserpass to integrate pass with Firefox/etc: https://github.com/browserpass/ https://github.com/browserpass/

nashashmi 4y ago

Totp.app is a great web app. So you can install on your phone as well

deleted 4y ago
[deleted]

Amorymeltzer 4y ago

From today! https://drewdevault.com/2022/10/18/TOTP-is-easy.html https://drewdevault.com/2022/10/18/TOTP-is-easy.html

computerfriend 4y ago

You can also store them on YubiKeys, accessible on the command line with ykman.

lukeschlather 4y ago

You need a TPM 2.0 compatible CPU, but something like this sounds really excellent: https://github.com/tpm2-software/tpm2-totp https://github.com/tpm2-software/tpm2-totp This means your laptop itself would be your hardware device, the TOTP secret would be stored in the TPM and theoretically impossible to steal/copy. Of course this means you will probably want a mobile device (possibly a second laptop also) as a backup.)

cryptonector 4y ago
Note that tpm2-totp is specifically meant to authenticate your laptop's state (TPM PCR values) to you, not you to some third system. But you could adapt tpm2-totp for the purpose of authenticating you to other systems.

emreb 4y ago

Authy used to have a Chrome client you can run on your computer that syncronizes all your secrets.

markstos 4y ago

You are looking for a Yubikey and `ykman`. This is secure because the secret never leaves the hardware key. This is convenient because you launch a tool with a global keyboard shortcut and copy/paste the code. I use `yubikey-oath-dmenu` to allow me to quickly filter to the TOTP code I need.

adamgordonbell 4y ago

I think you want oathtool. You can also use python's pyotp.totp.now() https://earthly.dev/blog/multi-factor-auth/ https://earthly.dev/blog/multi-factor-auth/

deleted 4y ago

[deleted]

austinjp 4y ago

I use https://github.com/pcarrier/gauth https://github.com/pcarrier/gauth It relies on file permissions so is not exactly robustly secure (no idea about RAM vulnerabilities etc). As per the author, I consider my laptop the fundamental point of vulnerability. If someone else gets access to it, I'll know and I'll hit the metaphorical panic button :) Edit: I recently set up a new laptop, and copied my OTP seeds from Aegis into gauth without a hitch. Another step closer to me moving away from Authy.