3 ms·

Yup. I use oath for everything with one exception. Screw "Duo," the company running my workplace that won't let me have my generating token without hackery.

by jrm4 4y ago

politelemon 4y ago
I avoid them like a plague. They are in some of our B2B systems and it's using their proprietary push rather than TOTP. I don't know what Duo has done to fool these Saas/B2B providers into integrating with them. Of course people who don't know better don't even understand the complaint and say "It's just an app on your phone".
gnufx 4y ago
I was going to add something on Duo before seeing that. If you have to use OTP with it, rather than FIDO, which I guess costs more, as my site doesn't support it, the hacks are fairly straightforward. On an Android phone, register a "tablet" (at least in the interface I see) using https://f-droid.org/en/packages/net.scintill.duotp/ https://f-droid.org/en/packages/net.scintill.duotp/ and then use Aegis with the secret. (Why do people persist on suggesting Google Authenticator?) On a desktop, see https://github.com/simonseo/nyuad-spammer/tree/master/spammer/duo https://github.com/simonseo/nyuad-spammer/tree/master/spamme... with an appropriate value of "start.nyu.edu". I use the secret with pass otp. Note that this is HOTP, not TOTP, so if you use the same secret on multiple devices, you need to synchronize the counter somehow, perhaps with a git hook under pass. (There are more baroque hacks to get the secret that I started with before finding those solutions.) If you do want something like Duo for an organization, possibly self-hosted, and free-software-friendly, then https://www.privacyidea.org/ https://www.privacyidea.org/ looks like a good option, but i have no experience with it.
- jrm4 4y ago
  Nice, I'll have to try this. I was under the impression that it had to be done with something rooted and I just never got around to it.

Yup. I use oath for everything with one exception. Screw "Duo," the company running my workplace that won't let me have my generating token without hackery.

by jrm4 4y ago

Yup. I use oath for everything with one exception. Screw "Duo," the company running my workplace that won't let me have my generating token without hackery.

politelemon 4y ago

I avoid them like a plague. They are in some of our B2B systems and it's using their proprietary push rather than TOTP. I don't know what Duo has done to fool these Saas/B2B providers into integrating with them. Of course people who don't know better don't even understand the complaint and say "It's just an app on your phone".

gnufx 4y ago

I was going to add something on Duo before seeing that. If you have to use OTP with it, rather than FIDO, which I guess costs more, as my site doesn't support it, the hacks are fairly straightforward. On an Android phone, register a "tablet" (at least in the interface I see) using https://f-droid.org/en/packages/net.scintill.duotp/ https://f-droid.org/en/packages/net.scintill.duotp/ and then use Aegis with the secret. (Why do people persist on suggesting Google Authenticator?) On a desktop, see https://github.com/simonseo/nyuad-spammer/tree/master/spammer/duo https://github.com/simonseo/nyuad-spammer/tree/master/spamme... with an appropriate value of "start.nyu.edu". I use the secret with pass otp. Note that this is HOTP, not TOTP, so if you use the same secret on multiple devices, you need to synchronize the counter somehow, perhaps with a git hook under pass. (There are more baroque hacks to get the secret that I started with before finding those solutions.) If you do want something like Duo for an organization, possibly self-hosted, and free-software-friendly, then https://www.privacyidea.org/ https://www.privacyidea.org/ looks like a good option, but i have no experience with it.

jrm4 4y ago
Nice, I'll have to try this. I was under the impression that it had to be done with something rooted and I just never got around to it.