Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TOTP Codes in the Terminal

jpmens.net

Post reply on HN
Print view View original

31–40 of 73 posts

Re: TOTP Codes in the Terminal

#31

Post by xyzzy_plugh »

Several comments here suggesting that using password managers for TOTP defeats the purpose of TOTP as a second factor. I don't agree.

I strongly prefer other factors (U2F/FIDO(2)/WebAuthn/Passkeys/whatever) but unfortunately TOTP is still extremely prevalent. Worse is when only a single secondary factor can be registered, in which case even if something other than SMS or TOTP is available, I slightly bias away from hardware security tokens in order to have a clear recovery path. I can at least back up most TOTP keys.

I agree that having a second vault for TOTP seems superior but from a UX and recovery perspective it's not so clear. Are both vaults available on all devices? Are they usually unlocked simultaneously? Is it likely that one vault but not the other would be stolen? Or you have a separate device or air-gap and now the usability adds friction. It seems like diminishing returns.

Conversely a single vault still offers significant protection from many attack vectors, including keyloggers and phishing. Even if access is obtained via MITM'ing a TOTP, the blast radius is often limited to a single session. Many services have poor session security, once established, but many do not. And in my experience it's still nearly impossible to get rid of SMS 2FA.

TOTP is almost always strictly better than SMS 2FA, and storing your TOTP keys alongside your passwords doesn't really diminish the effectiveness of TOTP very much at all. Unless you have the keys themselves exposed, they're still closer to "something you have" than "something you know", at least from where I'm sitting.

Their main weakness is that they can be backed up or copied at all, as well as MITM'd. How I securely store them doesn't have much impact.

Re: TOTP Codes in the Terminal

#32

Post by 22c »

mistrial9 wrote: post #3

TOTP codes acceptable to Github etc. can be generated via oathtool - Open AuTHentication (OATH) one-time password tool OATH Toolkit provide components to build one-time password authentication systems. It contains shared C libraries, command line tools and a PAM module. Supported technologies include the event-based HOTP algorithm (RFC 4226), the time-based TOTP algorithm (RFC 6238), and Portable Symmetric Key Contai…

I use an alias to oathtool to generate OTPs.

It seems like this method at least keeps the secret key inside 2FAS backups, so it's probably slightly better opsec.

Re: TOTP Codes in the Terminal

#33

Post by mcoliver »

xyzzy_plugh wrote: post #31

Several comments here suggesting that using password managers for TOTP defeats the purpose of TOTP as a second factor. I don't agree. I strongly prefer other factors (U2F/FIDO(2)/WebAuthn/Passkeys/whatever) but unfortunately TOTP is still extremely prevalent. Worse is when only a single secondary factor can be registered, in which case even if something other than SMS or TOTP is available, I slightly bias away from h…

Unless you were using LastPass and their Authenticator app. When they admitted that there had been unauthorized access to their storage and databases that had users vaults, what they failed to mention publicly (but which they finally told me after persistent questioning) was that the TOTP seeds were also part of the breach.

Re: TOTP Codes in the Terminal

#34

Post by iamawacko »

Scion9066 wrote: post #11
iamawacko wrote: post #9

rbw (a terminal client for Bitwarden) can also generate totp codes.

And the official CLI client for Bitwarden is here: https://bitwarden.com/help/cli/

Yeah, it's nice and all, but it's a node application and requires premium for TOTP.

rbw is written in Rust and doesn't need premium for TOTP.

Re: TOTP Codes in the Terminal

#35

Post by phyzome »

Frankly, I'm glad Authy Desktop is dead. It didn't allow exporting of TOTP secrets, so migrating off of it was a pain. I've been much, much happier with a tiny shell alias to oathtool and gpg.

For extra benefit, bind a keyboard shortcut and use xsel (Linux) or pbcopy (Mac) to drop the TOTP code into the clipboard. Now entering a frequent TOTP code is as simple as two keyboard chords.

(I only do this because my employer offers very limited options for MFA and I don't have a smartphone. I'd much rather use the Yubikeys I already have...)

Re: TOTP Codes in the Terminal

#36

Post by normaler »

I use aegis (previously i used andotp) and backup to a folder shared via syncthing. This allows me to usw OT via andotp -cli in emergency vor to use it in a new phone. For some i also use keepassxc (my credential/information store.) but the important ones. I prefer yubikeys, but keep totp AS a backup mechanism when i can add two methods.

Re: TOTP Codes in the Terminal

#37

Post by bawolff »

xyzzy_plugh wrote: post #31

Several comments here suggesting that using password managers for TOTP defeats the purpose of TOTP as a second factor. I don't agree. I strongly prefer other factors (U2F/FIDO(2)/WebAuthn/Passkeys/whatever) but unfortunately TOTP is still extremely prevalent. Worse is when only a single secondary factor can be registered, in which case even if something other than SMS or TOTP is available, I slightly bias away from h…

Most of the security benefits of TOTP is really for the service providers. Service providers get blamed when users are hacked because they used the same weak password across multiple websites. With TOTP service provider chooses the key the codes are derrived from, so user cannot choose a stupid one.

Most of the other threats that people talk about TOTP fixing are movie plot threats and not ones that happen in the real world to ordinary people. The only major exception is that webauthn prevents phishing, but TOTP cannot help with that.

Re: TOTP Codes in the Terminal

#38

Post by JoshTriplett »

xyzzy_plugh wrote: post #31

Several comments here suggesting that using password managers for TOTP defeats the purpose of TOTP as a second factor. I don't agree. I strongly prefer other factors (U2F/FIDO(2)/WebAuthn/Passkeys/whatever) but unfortunately TOTP is still extremely prevalent. Worse is when only a single secondary factor can be registered, in which case even if something other than SMS or TOTP is available, I slightly bias away from h…

> Their main weakness is that they can be backed up or copied at all

Which is also a major strength. I've had the experience of a phone app losing all of my TOTP information, and spending a long while having to use the recovery paths of various websites. After that experience, I want my second factor to be something I can back up and restore.

That'll continue to be true until either all websites reliably accept multiple 2FA devices (e.g. register multiple hardware keys) or I can buy multiple redundant hardware devices that produce the same TOTP codes so I can register "one" device with a site and still have a backup.

I wish the Firefox password manager had builtin TOTP support.

Re: TOTP Codes in the Terminal

#39

Post by cypherpunks01 »

PSA: Authy Desktop is being killed off this year, which could mean the last opportunity to export your tokens out of Authy (for migration, or for external backup)

There are a few gists floating around regarding how to export by remote chrome debugging an older version of Authy desktop app, which still worked for me recently. This page explains too:

https://jaketrent.com/post/export-authy-desktop-data/

Re: TOTP Codes in the Terminal

#40

Post by mook »

mksybr wrote: post #22
coppsilgold wrote: post #6

KeePassXC[1] password manager supports TOTP and I use it for that purpose in addition to storing passwords. It never made sense to me to use an app like Authy. I suspect most people make the assumption that an Authenticator app is something special that needs to talk to the service that issued the QR code/secret string. It's nothing more than a SHA1 hash of a secret string and an adjusted current time. [1] https://ke…

KeePassXC also has a cli interface suitably named keepassxc-cli, so for TOTP in the terminal its something like: keepassxc-cli show -q "$KEEPASS_DB_FILE" "$ENTRY_NAME" --totp edit: doubly so specifically regarding Authy since theyre discontinuing it on the desktop in a few months.

The keepassxc CLI reopens the database separately; it's actually possible to use git-credential-keepassxc† to do the scripting instead because it acts more like a browser (so it interacts with the already running instance of KeepassXC).

† https://github.com/frederick888/git-credential-keepassxc

Post reply on HN