Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TOTP Codes in the Terminal

jpmens.net

Post reply on HN
Print view View original

61–70 of 73 posts

Re: TOTP Codes in the Terminal

#61

Post by miggol »

bawolff wrote: post #37
xyzzy_plugh wrote: post #31

Several comments here suggesting that using password managers for TOTP defeats the purpose of TOTP as a second factor. I don't agree. I strongly prefer other factors (U2F/FIDO(2)/WebAuthn/Passkeys/whatever) but unfortunately TOTP is still extremely prevalent. Worse is when only a single secondary factor can be registered, in which case even if something other than SMS or TOTP is available, I slightly bias away from h…

Most of the security benefits of TOTP is really for the service providers. Service providers get blamed when users are hacked because they used the same weak password across multiple websites. With TOTP service provider chooses the key the codes are derrived from, so user cannot choose a stupid one. Most of the other threats that people talk about TOTP fixing are movie plot threats and not ones that happen in the rea…

Arguably storing TOTP tokens in your password manager does provide a level of protection against phishing.

You might fool me with that phishing page, but you won't fool my password manager's autofill. It would have to be full on MITM or DNS poisoning for that to work, which is already more of a movie plot.

Re: TOTP Codes in the Terminal

#62

Post by rendaw »

zimbatm wrote: post #60
evanb wrote: post #2

A pass[0] extension called pass-otp[1] can produce otp codes from the command line > pass edit git/hub [... put in your totp ...] otpauth://totp/GitHub/... then you can > pass otp -c git/hub Copied OTP code for git/hub to clipboard. Will clear in 45 seconds. pass-otp is also compatible with the passff firefox plugin; not sure beyond that. [0]: https://www.passwordstore.org/ [1]: https://github.com/tadfisher/pass-otp

Also worth looking at gopass[0], the Go re-implementation. It supports OPT out of the box. [0]: https://github.com/gopasspw/gopass

I used gopass for a while and regret it. They kept messing with the contents of passwords, sometimes in ways that it itself couldn't read. Adding `GOPASS-1.0` etc. I feel like it also did way too many encrypts/decrypts for each password (I'd have to press my hardware button 4 times just to rename a password I think). Slowly fixing all my passwords having moved back to pass.

I'm no fan of bash or pass's rather anemic built in structure but I don't feel like gopass were the right stewards.

Re: TOTP Codes in the Terminal

#63

Post by rendaw »

evanb wrote: post #2

A pass[0] extension called pass-otp[1] can produce otp codes from the command line > pass edit git/hub [... put in your totp ...] otpauth://totp/GitHub/... then you can > pass otp -c git/hub Copied OTP code for git/hub to clipboard. Will clear in 45 seconds. pass-otp is also compatible with the passff firefox plugin; not sure beyond that. [0]: https://www.passwordstore.org/ [1]: https://github.com/tadfisher/pass-otp

I think browserpass ff+chromium plugin supports otp as well. A nice thing is it's a native plugin so you can manage it with your system package manager (rather than the extension store).

Re: TOTP Codes in the Terminal

#64

Post by pxx »

Xophmeister wrote: post #25
crtasm wrote: post #7

Earlier quoted context omitted.

If you copy something else to the clipboard afterwards does it know not to clear it?

I wrote a CLI password manager as a personal project a few years ago and it would only clear the clipboard if the hash of the contents matched the hash of what was originally copied. I presume `pass` does something similar.

Hash? Why would you do any hashing? The domain is only so large so it's meaningless even if you cared about keeping the original bytes in RAM (which you don't).

This is the same concept behind the fact that it typically makes little to no sense to hash phone numbers or credit card numbers.

Re: TOTP Codes in the Terminal

#65

Post by GoblinSlayer »

pxx wrote: post #64
Xophmeister wrote: post #25

Earlier quoted context omitted.

I wrote a CLI password manager as a personal project a few years ago and it would only clear the clipboard if the hash of the contents matched the hash of what was originally copied. I presume `pass` does something similar.

Hash? Why would you do any hashing? The domain is only so large so it's meaningless even if you cared about keeping the original bytes in RAM (which you don't). This is the same concept behind the fact that it typically makes little to no sense to hash phone numbers or credit card numbers.

It makes sense if your password is something like hc0z3kjwedngwh4hgwct0-hunter2.

Re: TOTP Codes in the Terminal

#66

Post by bawolff »

miggol wrote: post #61
bawolff wrote: post #37

Earlier quoted context omitted.

Most of the security benefits of TOTP is really for the service providers. Service providers get blamed when users are hacked because they used the same weak password across multiple websites. With TOTP service provider chooses the key the codes are derrived from, so user cannot choose a stupid one. Most of the other threats that people talk about TOTP fixing are movie plot threats and not ones that happen in the rea…

Arguably storing TOTP tokens in your password manager does provide a level of protection against phishing. You might fool me with that phishing page, but you won't fool my password manager's autofill. It would have to be full on MITM or DNS poisoning for that to work, which is already more of a movie plot.

Sure, but that is true of your normal password as well. It doesn't add any additional security.

Re: TOTP Codes in the Terminal

#67

Post by cypherpunks01 »

fernandotakai wrote: post #59
cypherpunks01 wrote: post #39

PSA: Authy Desktop is being killed off this year, which could mean the last opportunity to export your tokens out of Authy (for migration, or for external backup) There are a few gists floating around regarding how to export by remote chrome debugging an older version of Authy desktop app, which still worked for me recently. This page explains too: https://jaketrent.com/post/export-authy-desktop-data/

i used this tool https://github.com/token2/authy-migration and it worked as expected. you just need to generate their html and on it, you will see a bunch of QR codes -- just use them to add a new TOTP to whatever tool you use.

Nice! That's a good find

Re: TOTP Codes in the Terminal

#68

Post by walteweiss »

miggol wrote: post #58
evanb wrote: post #2

A pass[0] extension called pass-otp[1] can produce otp codes from the command line > pass edit git/hub [... put in your totp ...] otpauth://totp/GitHub/... then you can > pass otp -c git/hub Copied OTP code for git/hub to clipboard. Will clear in 45 seconds. pass-otp is also compatible with the passff firefox plugin; not sure beyond that. [0]: https://www.passwordstore.org/ [1]: https://github.com/tadfisher/pass-otp

Neat! I should try this. Been using pass since forever. Does it support autofill on Android? GNU Pass is a great example of Unix-y interoperability for me. I sync the .password-store folder over to my phone with Syncthing, where the Password Store android app reads it. Password Store in turn talks to OpenKeychain for my encryption key with biometrics support. Changes are also synced back to my other devices. Each pie…

Why not sync it via git? It’s way better, imo.

Re: TOTP Codes in the Terminal

#69

Post by miggol »

walteweiss wrote: post #68
miggol wrote: post #58

Earlier quoted context omitted.

Neat! I should try this. Been using pass since forever. Does it support autofill on Android? GNU Pass is a great example of Unix-y interoperability for me. I sync the .password-store folder over to my phone with Syncthing, where the Password Store android app reads it. Password Store in turn talks to OpenKeychain for my encryption key with biometrics support. Changes are also synced back to my other devices. Each pie…

Why not sync it via git? It’s way better, imo.

Thing is, I often create or update passwords from my phone. I have yet to find a good UX for committing and pushing those changes from Android. Though I would be interested in that, because I have little protection against accidental deletion now.

With syncthing it's just instantly everywhere whenever I add an account, no action required. That's particularly useful when I create an account on my computer, then have to scan an OTP QR code with my phone. By the time my phone's out of my pocket the fresh account is already in the store to save the OTP code into.

Re: TOTP Codes in the Terminal

#70

Post by Xophmeister »

pxx wrote: post #64
Xophmeister wrote: post #25

Earlier quoted context omitted.

I wrote a CLI password manager as a personal project a few years ago and it would only clear the clipboard if the hash of the contents matched the hash of what was originally copied. I presume `pass` does something similar.

Hash? Why would you do any hashing? The domain is only so large so it's meaningless even if you cared about keeping the original bytes in RAM (which you don't). This is the same concept behind the fact that it typically makes little to no sense to hash phone numbers or credit card numbers.

The way my clipboard-clearer worked would have exposed* the plaintext secret if it wasn't hashed. Surely this would be generally true; however, in my case, it would have been particularly trivial to exfiltrate.

(* The clipboard exposure was more limited...although probably only in a "security by obscurity" sense :P)

Post reply on HN