rbw (a terminal client for Bitwarden) can also generate totp codes.
And the official CLI client for Bitwarden is here:
https://bitwarden.com/help/cli/
TOTP Codes in the Terminal
11–20 of 73 posts
Re: TOTP Codes in the Terminal
#12KeePassXC[1] password manager supports TOTP and I use it for that purpose in addition to storing passwords. It never made sense to me to use an app like Authy. I suspect most people make the assumption that an Authenticator app is something special that needs to talk to the service that issued the QR code/secret string. It's nothing more than a SHA1 hash of a secret string and an adjusted current time. [1] https://ke…
I only use KeePassXC for TOTPs now. Note it can work on Android too. There is often no good way to back up phone authentication apps without a cloud service, which is a problem if I ever lost or broke my phone, and it requires me to use a separate device when using my computer, which I'd rather not do.
Autofill can save you a lot of time if you prefer to usually stay logged out of websites (auto-deleting cookies, for example) but need to log in sometimes.
Re: TOTP Codes in the Terminal
#13KeePassXC[1] password manager supports TOTP and I use it for that purpose in addition to storing passwords. It never made sense to me to use an app like Authy. I suspect most people make the assumption that an Authenticator app is something special that needs to talk to the service that issued the QR code/secret string. It's nothing more than a SHA1 hash of a secret string and an adjusted current time. [1] https://ke…
For me it’s separation of secrets. If my vault is exposed they won’t be able to log in without the codes. Putting it all in one place is a bad idea, some may think.
What if you lost or somehow broke the phone? You'll be locked out your stuff faster than you'd expect. If you back it up to a cloud service, are you sure you can recover it without the TOTP? If you are backing it up to your computer, then it's already on your computer and will probably be compromised when your vault is, so you might as well use your vault anyways.
Re: TOTP Codes in the Terminal
#14For people storing One-Time Passwords in 1Password, you can access them in the terminal too:
op item get --otp
op item get --otp | pbcopy # MacOS
op item get --otp | xclip -sel c # LinuxRe: TOTP Codes in the Terminal
#15KeePassXC[1] password manager supports TOTP and I use it for that purpose in addition to storing passwords. It never made sense to me to use an app like Authy. I suspect most people make the assumption that an Authenticator app is something special that needs to talk to the service that issued the QR code/secret string. It's nothing more than a SHA1 hash of a secret string and an adjusted current time. [1] https://ke…
For me it’s separation of secrets. If my vault is exposed they won’t be able to log in without the codes. Putting it all in one place is a bad idea, some may think.
1Password wrote a blog post stating something similar. Basically it comes down to if you're using TOTP as a true second factor. If you are it really shouldn't even be accessible from the same device.
Re: TOTP Codes in the Terminal
#16A pass[0] extension called pass-otp[1] can produce otp codes from the command line > pass edit git/hub [... put in your totp ...] otpauth://totp/GitHub/... then you can > pass otp -c git/hub Copied OTP code for git/hub to clipboard. Will clear in 45 seconds. pass-otp is also compatible with the passff firefox plugin; not sure beyond that. [0]: https://www.passwordstore.org/ [1]: https://github.com/tadfisher/pass-otp
I use it almost every single day, it's pretty simple and neat, haven't had the need for anything fancier.
Re: TOTP Codes in the Terminal
#17KeePassXC[1] password manager supports TOTP and I use it for that purpose in addition to storing passwords. It never made sense to me to use an app like Authy. I suspect most people make the assumption that an Authenticator app is something special that needs to talk to the service that issued the QR code/secret string. It's nothing more than a SHA1 hash of a secret string and an adjusted current time. [1] https://ke…
For me it’s separation of secrets. If my vault is exposed they won’t be able to log in without the codes. Putting it all in one place is a bad idea, some may think.
Yeah, that's why I also don't use the OTP features in Bitwarden (Premium), despite using the software as my password manager.
On my computer, I also use a distinct password to protect my pass-otp secrets.
Re: TOTP Codes in the Terminal
#18Earlier quoted context omitted.
For me it’s separation of secrets. If my vault is exposed they won’t be able to log in without the codes. Putting it all in one place is a bad idea, some may think.
1Password wrote a blog post stating something similar. Basically it comes down to if you're using TOTP as a true second factor. If you are it really shouldn't even be accessible from the same device. https://blog.1password.com/totp-and-1password/
I suspect most people aren't though. Most people are just being forced or nudged to using it. The main purpose for platform providers to push TOTP is probably consumers reusing passwords leading to account compromise, but if you are using a password manager, you can generate high entropy single-use passwords which don't really have that problem.
Re: TOTP Codes in the Terminal
#19rbw (a terminal client for Bitwarden) can also generate totp codes.
Just be careful not to use the same account/database/vault for OTPs and passwords, when using a manager like Bitwarden or KeePass, otherwise they no longer contribute a second factor to your authentication.
To be honest, password managers that support TOTPs should always come with a very clear disclaimier that keeping all your eggs in the same basket is a detriment to your safety, and that you should either use a different software for these codes or a separate account. I don't believe they do, but correct me if I'm wrong.
Re: TOTP Codes in the Terminal
#20Implementing TOTP is a fun exercise to learn crypto. But key storage is a bit more interesting as it has so many different approaches and trade offs.
Yeah, seems like a small enough thing to get your hands dirty. Might give it a shot soon, thank you for the suggestion!