Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TOTP Codes in the Terminal

jpmens.net

Post reply on HN
Print view View original

51–60 of 73 posts

Re: TOTP Codes in the Terminal

#51

Post by willmacdonald »

cypherpunks01 wrote: post #39

PSA: Authy Desktop is being killed off this year, which could mean the last opportunity to export your tokens out of Authy (for migration, or for external backup) There are a few gists floating around regarding how to export by remote chrome debugging an older version of Authy desktop app, which still worked for me recently. This page explains too: https://jaketrent.com/post/export-authy-desktop-data/

If you have a M1/2/3 Mac you can install the iPad version of Authy which works as a replacement.

Re: TOTP Codes in the Terminal

#52

Post by McGuffin »

phyzome wrote: post #35

Frankly, I'm glad Authy Desktop is dead. It didn't allow exporting of TOTP secrets, so migrating off of it was a pain. I've been much, much happier with a tiny shell alias to oathtool and gpg. For extra benefit, bind a keyboard shortcut and use xsel (Linux) or pbcopy (Mac) to drop the TOTP code into the clipboard. Now entering a frequent TOTP code is as simple as two keyboard chords. (I only do this because my employ…

It is actually doable to export secrets from authy desktop, but it involves starting it in debug mode and connecting chrome to it (it's an electron app). It was the solution I found to extract the secrets back when I set up https://pypi.org/project/totp/

Re: TOTP Codes in the Terminal

#54

Post by 8organicbits »

Xophmeister wrote: post #25
crtasm wrote: post #7

Earlier quoted context omitted.

If you copy something else to the clipboard afterwards does it know not to clear it?

I wrote a CLI password manager as a personal project a few years ago and it would only clear the clipboard if the hash of the contents matched the hash of what was originally copied. I presume `pass` does something similar.

I don't think it does, it looks like it clears the clipboard and then restores the previous clipboard item. Your suggestion seems better.

https://git.zx2c4.com/password-store/tree/src/password-store...

Re: TOTP Codes in the Terminal

#55

Post by curben »

coppsilgold wrote: post #6

KeePassXC[1] password manager supports TOTP and I use it for that purpose in addition to storing passwords. It never made sense to me to use an app like Authy. I suspect most people make the assumption that an Authenticator app is something special that needs to talk to the service that issued the QR code/secret string. It's nothing more than a SHA1 hash of a secret string and an adjusted current time. [1] https://ke…

for anyone new keepassxc, do check out the auto-type feature. you can trigger it (through keyboard shortcut) to type TOTP digits.

Re: TOTP Codes in the Terminal

#56

Post by nemo8551 »

roydivision wrote: post #47
Sarkie wrote: post #45

Sadly nothing to do with Top Of The Pops

TOTP will forever mean Top Of The Pops[0] for me first. I'm reassured that I'm not the only one. Thursday nights have never been the same. [0] https://en.wikipedia.org/wiki/Top_of_the_Pops

I scrolled down hoping to see this mentioned.

If it wasn’t I was going to bring it up, faith in lip synced music telly reconfirmed.

Re: TOTP Codes in the Terminal

#57

Post by Borealid »

alwayslikethis wrote: post #18
pseufaux wrote: post #15

Earlier quoted context omitted.

1Password wrote a blog post stating something similar. Basically it comes down to if you're using TOTP as a true second factor. If you are it really shouldn't even be accessible from the same device. https://blog.1password.com/totp-and-1password/

I suspect most people aren't though. Most people are just being forced or nudged to using it. The main purpose for platform providers to push TOTP is probably consumers reusing passwords leading to account compromise, but if you are using a password manager, you can generate high entropy single-use passwords which don't really have that problem.

A TOTP protects you against a replay of your password after it's typed into a compromised computer.

Re: TOTP Codes in the Terminal

#58

Post by miggol »

evanb wrote: post #2

A pass[0] extension called pass-otp[1] can produce otp codes from the command line > pass edit git/hub [... put in your totp ...] otpauth://totp/GitHub/... then you can > pass otp -c git/hub Copied OTP code for git/hub to clipboard. Will clear in 45 seconds. pass-otp is also compatible with the passff firefox plugin; not sure beyond that. [0]: https://www.passwordstore.org/ [1]: https://github.com/tadfisher/pass-otp

Neat! I should try this. Been using pass since forever. Does it support autofill on Android?

GNU Pass is a great example of Unix-y interoperability for me. I sync the .password-store folder over to my phone with Syncthing, where the Password Store android app reads it. Password Store in turn talks to OpenKeychain for my encryption key with biometrics support. Changes are also synced back to my other devices. Each piece of the puzzle can focus on doing one thing and doing it well, even on Android!

Password store for android: https://f-droid.org/packages/dev.msfjarvis.aps/ Openkeychain: https://f-droid.org/packages/org.sufficientlysecure.keychain...

Re: TOTP Codes in the Terminal

#59

Post by fernandotakai »

cypherpunks01 wrote: post #39

PSA: Authy Desktop is being killed off this year, which could mean the last opportunity to export your tokens out of Authy (for migration, or for external backup) There are a few gists floating around regarding how to export by remote chrome debugging an older version of Authy desktop app, which still worked for me recently. This page explains too: https://jaketrent.com/post/export-authy-desktop-data/

i used this tool https://github.com/token2/authy-migration and it worked as expected.

you just need to generate their html and on it, you will see a bunch of QR codes -- just use them to add a new TOTP to whatever tool you use.

Re: TOTP Codes in the Terminal

#60

Post by zimbatm »

evanb wrote: post #2

A pass[0] extension called pass-otp[1] can produce otp codes from the command line > pass edit git/hub [... put in your totp ...] otpauth://totp/GitHub/... then you can > pass otp -c git/hub Copied OTP code for git/hub to clipboard. Will clear in 45 seconds. pass-otp is also compatible with the passff firefox plugin; not sure beyond that. [0]: https://www.passwordstore.org/ [1]: https://github.com/tadfisher/pass-otp

Also worth looking at gopass[0], the Go re-implementation. It supports OPT out of the box.

[0]: https://github.com/gopasspw/gopass

Post reply on HN