6 ms·
MinTOTP – Minimal TOTP generator in 20 lines of Python
- nashashmi 4y agoKind of offtopic. IPhone has a totp password key store in icloud. It is very unknown feature.
- loloquwowndueo 4y agoDocs or it didn’t happen.
- nashashmi 4y agohttps://support.apple.com/guide/iphone/automatically-fill-in-verification-codes-ipha6173c19f/ios https://support.apple.com/guide/iphone/automatically-fill-in...
- loloquwowndueo 4y agoThis is amazing ! Thanks so much!
- slim 4y agocan't decide if this is genuine excitement or sarcasm. good job, both of you.
- loloquwowndueo 4y agoIt’s not sarcasm :)
- nashashmi 4y agobunch of upvotes tells me this is real for everyone.
- jsjohnst 4y agoIt can be done as a bash one liner, so yeah, definitely doable in minimal lines of Python code. More than 50% of this file is “overhead” even.
- tyingq 4y agoI don't see any fluff myself. Where's the overhead?
- tantalor 4y agoWrapper functions, imports, input handling, etc.
- jsjohnst 4y agoIt’s not “fluff”, it’s overhead. The real work there is done in about 4 lines (which could be compacted to two and still be somewhat readable). The rest as someone else already said, imports, helper functions (there’s no technical need for totp to just be a wrapper around hotp unless you want to expose hotp or be illustrative), function overhead, etc. That said, TOTP shouldn’t be treated as code golf, especially in production code. The point is the protocol is trivially simple to implement not that it’s X lines in Y language.
- tyingq 4y agoAh, okay. It doesn't appear overly golfed to me. It felt like the point of publishing it was probably similar to what you're saying. That the TOTP algorithm isn't terribly complicated.
- masklinn 4y agoIt's not golfed at all, it's more or less where you get when you implement TOTP by hand from the RFCs. Except for the final reduction, which in the RFC is implemented via a mod, and the base32 decoding, which is not part of either HOTP or TOTP RFCs, but is instead part of the ad hoc "key uri" format. Which is a funny spec because it was defined for Google Authenticator yet AFAIK GA uses none of the parametrisation so that's only useful if you specifically want to exclude GA users.
- ranger_danger 4y agoNot pictured: the wall of incomprehensible math code implementing SHA1. Most languages do not provide such implementations by default so I struggle to really call this only 20 lines.
- bvrmn 4y agoWhat other library functions you consider as "cheating"?
- otachack 4y agoFair assessment, but the crypto community has that one high standard of "don't roll your own crypto" unless you have to or it's a learning project. Now I'm interested in a minimal SHA-1 implementation!
- ranger_danger 4y agohttps://github.com/RavuAlHemio/cpptotp/blob/master/src/libcppotp/sha1.cpp https://github.com/RavuAlHemio/cpptotp/blob/master/src/libcp...
- bvrmn 4y agoHuge thanks to author. I use mintotp pretty much always I need to get token from "pass" stored secret.
- FrenchyJiby 4y agoHuh, have you heard of the popular pass(1) extension pass-opt[1]? It allows one to get OTP secrets via a simple: pass otp secretname # Add -c for clipboard, as usual And because the OTP side is just a otpauth:// URL on a line of the GPG file, we can still use the rest of the secret for other things: pass secretname -c Real smooth! [1]: https://github.com/tadfisher/pass-otp https://github.com/tadfisher/pass-otp
- macintux 4y agoActive discussion about TOTP underway here: https://news.ycombinator.com/item?id=33245042 https://news.ycombinator.com/item?id=33245042
- FerretFred 4y agoWoohoo! Thanks for that susam - I can now use this on my Pi Zero portable computer project: the missing piece! The GPG option is sneakily good also.
- michaelhoffman 4y agoHats off to the author for providing 482 lines of documentation (sloc) to accompany it!
- nathancahill 4y agoTangentially, I wrote a Python generator for the Duo TOTP app which draws from local iOS backups: https://nathancahill.com/duo-cli https://nathancahill.com/duo-cli
- teach 4y agoThis reminds me a lot of my own attempt[0] from a few years back, but packaged as a Python module instead of a standalone script. [0] https://github.com/grahammitchell/google-authenticator https://github.com/grahammitchell/google-authenticator
- account-5 4y agoThere's Go and Ruby clones from the issues. This even seems something I could do myself, nice!
- bwblabs 4y agoShameless plug of my TOTP in '4' lines of PL/pgSQL: https://gist.github.com/bwbroersma/676d0de32263ed554584ab132434ebd9 https://gist.github.com/bwbroersma/676d0de32263ed554584ab132...
- joshka 4y agoI'd call this 7 lines rather than 20. The rest is function definition and argument parsing. But really it should be just 1: pyotp.TOTP('base32secret3232').now() Why is this relevant? Because it's inadvisable to write security related software if you're not prepared to take on the full range of possible problems that introducing another security library brings (CVEs, supply chain security, etc.). The adage that doing security right requires doing everything right. Doing security wrong only takes 1 thing.