DontDuo: Bypass 2FA with DTMF Tones

>Or instead of handing over your second factor authentication to a startup web service, you could buy a Yubikey

...assuming the service in question accepts yubikeys, or even TOTPs. I've seen plenty of services (mostly financial) that only allow sms or voice calls.

TPMs built into managed devices; USB hardware tokens for others.

Duo implements a proprietary setup layer over HOTP (counter based instead of time based, useful for hardware key generators that don't have a clock). I needed it for my University and internship, and was able to set it up on an Android emulator (or rooted device), copy the secret key and counter off of the app's config file, and then use it on my laptop.

On the computer I have ~/.totp/ which contains files like `github` with the secret key as the file content. In my bashrc I made a function which runs oathtool on the contents of the given filename to generate the 6 digit code and then copies it to the clipboard with xclip (run it like `$ totp github`).

For the duo thing, I had to make the same `name` file with the secret key as the content, and a `name-counter` file with an integer. I put a hotp function in bashrc, so running `hotp name` generates the 6 digit code, copies it to the clipboard, and increments the counter.

I had to tell Duo I was adding a tablet (since the emulator had no phone number), it gives a QR code with a URL as a backup; I opened the URL in the emulator which opened the Duo app in the emulator and finished the setup. Then on the host computer run adb shell and cat out /data/data/com.duosecurity.duomobile/files/duokit/accounts.json from the emulator shell (or the shell on your rooted Android)

Get the 'otpSecret' and counter, at the end of otpSecret replace the \u003d with its actual character: '=', then put the secret into the file ~/.otp/name and the counter into ~/.otp/name-counter

Turns out I actually put a tiny script in my PATH instead of adding a function to bashrc:

    #!/bin/sh
    typeset -i counter=$(~/.otp/name-counter

On macOS there's a `clip` command which you will have to use instead of xclip to copy to clipboard.

I have saved a very old (2 years?) version of the Duo APK which works great for this (or at least was working great the last time I tried, 2 months ago). The newer app versions refuse to run without Google Play Services, but you can still make a throwaway andorid emulator with GPS. I'd like to share the APK I have, but no way to do so without linking this pseudonym to my real identity...

The most idiotic thing is that basically the entire 2FA ecosystem fucked up into turning 2FA into phoneFA. Your password is a secret, it can be guessed by some hacker on the other side of the world, so let's have two secrets, with the second one being unguessably long and only known to your hardware, so that it can make a human-sized login code. There are standards for this like TOTP and HOTP, but instead of having basically password managers for these secret keys, we get SMS auth and Duo and Authy, with no way for a normal person to generate otp codes on their actual computer. Google Authenticator and even the Duo app actually allow you to scan QR codes with TOTP secret keys and get the 6 digit OTPs from their app, but Duo itself won't let you use the standards to login, or to do it on your computer.

For completeness, here's the TOTP function in my bashrc:

    function totp() {
     oathtool --totp -b $(

So if you have a file ~/.totp/github with the secret key as the content, you would open a terminal (or something like Guake/Yakuake) and run the command `totp github` and the 6-digit OTP would be in your clipboard.