7 ms·
TOTP Authentication with Free Software
- joveian 3y agoFor desktop I personally use: https://github.com/arachsys/totp https://github.com/arachsys/totp It is a very simple application that can be reviewed quickly. I use it from a separate local account that does nothing else to make it at least a bit more second factor-y than a different application in the same account as the browser. You could use the scrypt utility on the data and "scrypt dec data.enc | ./totp" to get the TOTP.
- fbdab103 3y agoI like minitotp[0] which only uses the Python standard library available from Python 3.4 and above. [0] https://github.com/susam/mintotp https://github.com/susam/mintotp
- savoyard 3y agoFor command-line use, there is oathtool, which is part of the OATH Toolkit by Simon Josefsson. https://oath-toolkit.nongnu.org https://oath-toolkit.nongnu.org
- tyingq 3y agoA little golfed, but TOTP in python, using only base/included modules, is not much code. https://github.com/susam/mintotp/blob/main/mintotp.py https://github.com/susam/mintotp/blob/main/mintotp.py
- nayuki 3y agoMy minimal, open-source implementations in a couple of languages: https://www.nayuki.io/page/time-based-one-time-password-tools https://www.nayuki.io/page/time-based-one-time-password-tool... The shortest one I have is a 6-line Python function using only the standard library. I noticed that all the major tech companies support TOTP 2FA - e.g. Google, Amazon, Uber, Dropbox, etc. At the same time, I am very annoyed that seemingly none of the Canadian banks or CRA support it. They either use SMS/PSTN or a proprietary mobile-only application (no desktop version). Is the industry standard not good enough for ya?
- deleted 3y ago[deleted]
- toastal 3y agoMeanwhile a bunch of crappy apps like $BANK1 use Symantec's implementation which is just TOTP with extra steps (there's a Python script out there that masquerades like a macOS device to get you the raw TOTP code) and $BANK2 & $BANK3 only allow TOTP inside their application (security through obscurity). Icing the cake, most that prompt for a third-party option say something like “Scan the code with Google™ Authenicator™” instead of using a generic term. Why is it so _hard_ for folks to support generic TOTP?
- sebk 3y agoFortunately you can undo these steps for $BANK1 and use your TOTP authenticator of choice: https://github.com/dlenski/python-vipaccess https://github.com/dlenski/python-vipaccess e: I think you added a reference to this as I was writing my comment :)
- toastal 3y agoI did sneak that in after the post, but thanks for the link to those that didn't know about it.
- omoikane 3y agoI think that spoofs Symantec's app, so while it allows an undesirable app to be avoided, it doesn't eliminate communication with an undesirable third party.
- playingalong 3y agoTOTP don't require communication with issuer, including Symantec here.
- omoikane 3y agoMy apologies, I guess I read these bits wrong. https://github.com/dlenski/python-vipaccess/blob/cc4366f7bce41d5ebce64ae8d86cc71e5eda5703/vipaccess/provision.py#L41 https://github.com/dlenski/python-vipaccess/blob/cc4366f7bce... https://github.com/dlenski/python-vipaccess/issues/39#issuecomment-628741743 https://github.com/dlenski/python-vipaccess/issues/39#issuec...
- Xaiph_Rahci 3y agoAsk HN: If TOTPs are generated from desktop applications, can they still be called Two Factor Authentication?
- heywoodlh 3y agoI'm going off the assumption that you mean storing your password and TOTP secret in the same app. Personally, I think storing your password and TOTP secret is worthwhile, but it ultimately depends on your threat model. If your threat model is someone walking up to your unlocked desktop and unlocked password manager, then it's not very effective. That being said, I believe a determined enough attacker will always win -- just be more annoying to pwn than others and you will sift out the majority of attackers, imo. But, if your threat model is that a website you use suffers a data breach and your username/password hashes are stolen, you have an extra line of defense with that second factor. This pretty much happens or will happen to everyone with online accounts at some point. So my long-winded answer is that I do still consider it two factor auth, and I do think it's worthwhile -- but all effective security should be layered with extra defenses when possible. EDIT: fixed some grammar, added some extra context.
- woodruffw 3y agoIt's also worth noting that the "physical attacker" scenario is outside of most people's threat models, even if they think that it isn't: most people leave their physical second factors plugged into their devices or on their desks, and interposing between a user's computer and their keyboard doesn't require any technical ability (only the ability to plug and unplug a USB). The risk with same-device (or same-manager TOTP) isn't necessarily in a physical adversary (who's going to win anyways), but in a digital adversary who can run code (or read files) on one device but not several. That's one of the main reasons users are encouraged to use physical factors or, lacking that, an on-device factor that requires some kind of OS-mediated privileged interaction.
- Xaiph_Rahci 3y ago> I'm going off the assumption that you mean storing your password and TOTP secret in the same app. Yes, correct. > So my long-winded answer is that I do still consider it two factor auth. Ok, thanks for sharing your thoughts.
- jrm4 3y agoYup. I use oath for everything with one exception. Screw "Duo," the company running my workplace that won't let me have my generating token without hackery.
- politelemon 3y agoI avoid them like a plague. They are in some of our B2B systems and it's using their proprietary push rather than TOTP. I don't know what Duo has done to fool these Saas/B2B providers into integrating with them. Of course people who don't know better don't even understand the complaint and say "It's just an app on your phone".
- gnufx 3y agoI was going to add something on Duo before seeing that. If you have to use OTP with it, rather than FIDO, which I guess costs more, as my site doesn't support it, the hacks are fairly straightforward. On an Android phone, register a "tablet" (at least in the interface I see) using https://f-droid.org/en/packages/net.scintill.duotp/ https://f-droid.org/en/packages/net.scintill.duotp/ and then use Aegis with the secret. (Why do people persist on suggesting Google Authenticator?) On a desktop, see https://github.com/simonseo/nyuad-spammer/tree/master/spammer/duo https://github.com/simonseo/nyuad-spammer/tree/master/spamme... with an appropriate value of "start.nyu.edu". I use the secret with pass otp. Note that this is HOTP, not TOTP, so if you use the same secret on multiple devices, you need to synchronize the counter somehow, perhaps with a git hook under pass. (There are more baroque hacks to get the secret that I started with before finding those solutions.) If you do want something like Duo for an organization, possibly self-hosted, and free-software-friendly, then https://www.privacyidea.org/ https://www.privacyidea.org/ looks like a good option, but i have no experience with it.
- jrm4 3y agoNice, I'll have to try this. I was under the impression that it had to be done with something rooted and I just never got around to it.
- arunc 3y agoI use the following: 1. On Android: Authenticator pro 2. On desktop: KeePass (with totp support) [1] https://play.google.com/store/apps/details?id=me.jmh.authenticatorpro https://play.google.com/store/apps/details?id=me.jmh.authent... [2] https://keepass.info/help/base/placeholders.html#otp https://keepass.info/help/base/placeholders.html#otp
- VTimofeenko 3y agoPass's store can also be used on Android through an app[1]. Using a combination of termux + okcagent it's possible to unlock it through a hardware key [1]: https://f-droid.org/packages/dev.msfjarvis.aps/ https://f-droid.org/packages/dev.msfjarvis.aps/
- mickeyp 3y agoI use Emacs to do this. Here's how: https://www.masteringemacs.org/article/securely-generating-totp-tokens-emacs https://www.masteringemacs.org/article/securely-generating-t... I securely store the master key using Emacs's builtin support for GPG and then decrypt the file on-the-fly to generate a TOTP token, which I select from a dropdown. All-in-all, I can have a key in seconds and paste it anywhere.
- politelemon 3y agoFWIW, KeePassDX can also handle TOTP, it's on FDroid too https://www.keepassdx.com/ https://www.keepassdx.com/
- XorNot 3y agoKeepass2Android will do it too if you have the fields recorded from the desktop TOTP plugin.
- skarlso 3y agoIf you want to stay in the command line there is an excellent cli you can use https://github.com/yitsushi/totp-cli https://github.com/yitsushi/totp-cli. It’s an excellent tool that has great encryption and handles multiple accounts and can paste into your clipboard with `totp account.name|pbcopy` and asks for a password on stderr. Pretty cool stuff.
- linuxandrew 3y agohttps://freeotp.github.io/ https://freeotp.github.io/ is yet another TOTP provider by Red Hat. It's the only app that I've used so far. Available from F-Droid plus the usual places. There's also a fork FreeOTP+ by some people who have different ideas about the security model and enabling backup of keys.
- yrro 3y agoFreeOTP supports backups itself these days. Backups can go to local or cloud storage. Backups are encrypted with a passphrase that you enter when you set the app up, so the cloud storage providers can't grab your keys.
- Turukawa 3y agoOn the other end, I integrated TOTP into the auth workflow for a full stack FastAPI base project generator (https://github.com/whythawk/full-stack-fastapi-postgresql https://github.com/whythawk/full-stack-fastapi-postgresql). TOTP is great, but developers need to start adding it to their apps by default.
- baumschubser 3y agoGoing digital detox but still want that sweet 2FA? My J2ME vintage feature phone HOTP/TOTP app has you covered. https://github.com/baumschubser/hotpants https://github.com/baumschubser/hotpants
- 10729287 3y agoThis is awesome. Especially for businesses that need to share a 2FA device between members for occasional uses. This is our case and the good old Iphone 7 we use for that is always battery empty when we need it !
- navigate8310 3y agoThank you for sharing, this will come in handy at my workplace.
- systemtest 3y agoWhat if something happens to the phone?
- detrites 3y agoYou backed up the key.
- systemtest 3y agoThat is good to hear. I was under the impression that with TOTP you could only initialise once.
- detrites 3y agoIt can depend on the vendors implementation, but usually they will provide the key in some readable form for the purposes of backup. If they don't, but do use QR codes, screen grabbing the QR code may work for the purpose. It is possible however that a vendor can choose to obfuscate the key in an app or through some other method. Technically it's in there somewhere, but may be hard to extract. In the case of this phone however the only way in is to have a key.
- haunter 3y ago2fas.com is FOSS too https://2fas.com/ https://2fas.com/ https://github.com/twofas https://github.com/twofas
- raybb 3y agoWhat is the story with this tool. They seems to be popping up more recently but I haven't heard too much fanfare. How's the project funded and do people it?
- dmichulke 3y agoRelated: I have EU bank accounts and each bank wants me to use some app as a second factor (it's not TOTP). The apps are large, I don't trust them, and I don't have access to e.g. Play store (of course, no bank serves the app on F-Droid) because I use google-free LineageOs on my phone. Is there any way to use a single FOSS app instead of the crap each bank is serving me? Both desktop and phone apps would be ok.
- adityamwagh 3y agoI use Microsoft Authenticator personally on iOS and Windows. BitWarden is a good Open Spurce option, it’s cross platform but the TOPT stuff is available only with a paid plan.
- stefan_ 3y agoMicrosoft Authenticator is the app that would literally refuse to work unless you first consented to data sharing and telemetrics. No fucking go. Thankfully, F-Droid has a useful alternative (Android only, of course): https://github.com/beemdevelopment/Aegis https://github.com/beemdevelopment/Aegis
- kramerger 3y agoPro tip: install a VPN firewall (such as NetGuard on Android). Now watch MS Authenticators do tons of network connections to various Microsoft services and analytics servers every 5 seconds or so. Probably same with Googles app.
- red_admiral 3y agoThe issue with TOTP here is it can only provide a 6-digit code, whereas an app can show for example "Do you want to authorise $6.21 at McDonalds?" before sending a transaction through. Grudgingly, I will accept that for most of the customer base this is probably the correct solution. If there is a move in this area, I predict it will come from something like EU regulations on interoperability (we already have rules on Open Banking to some extent) - something to bear in mind next time the EU's approach to regulation is criticised as "anti-tech".
- pahn 3y agoJust as it took me myself quite a while to find that: A simple, good and open-source solution for 2fa on iOs is Tofu. App store: https://apps.apple.com/us/app/tofu-authenticator/id1082229305 https://apps.apple.com/us/app/tofu-authenticator/id108222930... Github: https://github.com/iKenndac/Tofu https://github.com/iKenndac/Tofu (not affiliated, just a happy user)
- e12e 3y agoJust a note that Bitwarden can store and display TOTP - But with the default service a paid account is required (it can be enabled if you run your own vaultwarden afaik - or if you are on any paid plans). TIL that you can manually edit the otp URI - so I'm guessing it's possible to use it for Blizzard Battle.net too? https://bitwarden.com/help/authenticator-keys/#support-for-more-parameters https://bitwarden.com/help/authenticator-keys/#support-for-m... https://discussion.enpass.io/index.php?/topic/14284-totp-for-battlenet-possible/ https://discussion.enpass.io/index.php?/topic/14284-totp-for... (From the last one - relevant URI): > blizzard otpath string in this format: otpauth://totp/BattleNet:Battlenet?secret=<SECRET GOES HERE>&issuer=BattleNet&digits=8&serial=<SERIAL GOES HERE> (Looks like bitwarden drops the issuer-param)
- loloquwowndueo 3y agoTomu is a tiny programmable device that fits in a usb port. One of the available things that can be loaded on it is a totp authenticator http://tomu.im/tomu.html http://tomu.im/tomu.html
- rwky 3y agoOne thing I like about using keepassxc is that it has a cli tool built in so I get the best of both worlds https://keepassxc.org/docs/KeePassXC_UserGuide#_command_line_tool https://keepassxc.org/docs/KeePassXC_UserGuide#_command_line...
- hsjqllzlfkf 3y agoNo mention of andOTP...?