Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TOTP Codes in the Terminal

jpmens.net

Post reply on HN
Print view View original

21–30 of 73 posts

Re: TOTP Codes in the Terminal

#21

Post by TacticalCoder »

I wrote once many years ago, showing me all my TOTP codes in a terminal. I'd run it on a text-only offline/airgapped Raspberry Pi (an old one, with not even WiFi capabilities).

I was also pissed off by the clock issue, so I'd show both the previous, present and next code to come: because it's really a PITA when you see 213987 but you've got only two seconds left before it rolls. So I may as well start entering the next code (what the server accept is something not in my control).

And I always, always, always have a known, public, 2FA which I can use to double-check that everything is smooth (for example by entering it on some online computer and verifying that I get the same tokens generated).

I just reused whatever 2FA/TOTP Java library I found and wrapped that in a little CLI utility.

My secrets were unlocked by entering a password when I'd start the app.

Re: TOTP Codes in the Terminal

#22

Post by mksybr »

coppsilgold wrote: post #6

KeePassXC[1] password manager supports TOTP and I use it for that purpose in addition to storing passwords. It never made sense to me to use an app like Authy. I suspect most people make the assumption that an Authenticator app is something special that needs to talk to the service that issued the QR code/secret string. It's nothing more than a SHA1 hash of a secret string and an adjusted current time. [1] https://ke…

KeePassXC also has a cli interface suitably named keepassxc-cli, so for TOTP in the terminal its something like:

   keepassxc-cli show -q "$KEEPASS_DB_FILE" "$ENTRY_NAME" --totp
edit: doubly so specifically regarding Authy since theyre discontinuing it on the desktop in a few months.

Re: TOTP Codes in the Terminal

#23

Post by AlexanderTheGr8 »

TacticalCoder wrote: post #21

I wrote once many years ago, showing me all my TOTP codes in a terminal. I'd run it on a text-only offline/airgapped Raspberry Pi (an old one, with not even WiFi capabilities). I was also pissed off by the clock issue, so I'd show both the previous, present and next code to come: because it's really a PITA when you see 213987 but you've got only two seconds left before it rolls. So I may as well start entering the ne…

You don't need to use the previous, present, and next code. Most decently implemented TOTP servers take time-sync-issues into account and accept codes a few seconds here and there. They do this also bec the time for a packet to move around the earth can also sometimes take a couple seconds.

Your setup on raspberry Pi sounds complicated. Mine was simpler. Just a CLI showing totp. Less secure but more convenient.

Re: TOTP Codes in the Terminal

#25

Post by Xophmeister »

crtasm wrote: post #7
evanb wrote: post #2

A pass[0] extension called pass-otp[1] can produce otp codes from the command line > pass edit git/hub [... put in your totp ...] otpauth://totp/GitHub/... then you can > pass otp -c git/hub Copied OTP code for git/hub to clipboard. Will clear in 45 seconds. pass-otp is also compatible with the passff firefox plugin; not sure beyond that. [0]: https://www.passwordstore.org/ [1]: https://github.com/tadfisher/pass-otp

If you copy something else to the clipboard afterwards does it know not to clear it?

I wrote a CLI password manager as a personal project a few years ago and it would only clear the clipboard if the hash of the contents matched the hash of what was originally copied. I presume `pass` does something similar.

Re: TOTP Codes in the Terminal

#26

Post by imrehg »

mksybr wrote: post #22
coppsilgold wrote: post #6

KeePassXC[1] password manager supports TOTP and I use it for that purpose in addition to storing passwords. It never made sense to me to use an app like Authy. I suspect most people make the assumption that an Authenticator app is something special that needs to talk to the service that issued the QR code/secret string. It's nothing more than a SHA1 hash of a secret string and an adjusted current time. [1] https://ke…

KeePassXC also has a cli interface suitably named keepassxc-cli, so for TOTP in the terminal its something like: keepassxc-cli show -q "$KEEPASS_DB_FILE" "$ENTRY_NAME" --totp edit: doubly so specifically regarding Authy since theyre discontinuing it on the desktop in a few months.

They are discontinuing Authy Desktop in 3 weeks (March 19th), brought forward (!) from August. https://help.twilio.com/articles/19753631228315

Re: TOTP Codes in the Terminal

#27

Post by Jakob »

timenova wrote: post #14

For people storing One-Time Passwords in 1Password, you can access them in the terminal too: op item get --otp To copy to clipboard just use pbcopy or xclip: op item get --otp | pbcopy # MacOS op item get --otp | xclip -sel c # Linux

I like 1Password `op run` which works without copying. You put environment variables in your code, and when run with `op run` these variables are replaced on runtime with the actual credentials:

https://developer.1password.com/docs/cli/secret-references/#...

Re: TOTP Codes in the Terminal

#28

Post by jclulow »

Tmpod wrote: post #19
iamawacko wrote: post #9

rbw (a terminal client for Bitwarden) can also generate totp codes.

Just be careful not to use the same account/database/vault for OTPs and passwords, when using a manager like Bitwarden or KeePass, otherwise they no longer contribute a second factor to your authentication. To be honest, password managers that support TOTPs should always come with a very clear disclaimier that keeping all your eggs in the same basket is a detriment to your safety, and that you should either use a dif…

I've thought about this a lot, and I feel that it's not really as big a detriment to safety as you might expect. It's not exactly the same as an air gapped token generator, obviously, but:

- It's still something you have, and don't know: the TOTP secret. What you transmit is a short term generated code, but unlike your password, you don't send the secret key at any point.

- The downside of air gapped tokens is that when they break or are lost or stolen, you have to somehow re-enroll with a new device. The security properties of this process are deeply variable between authorities, and there's always the risk of just total loss of access. If you have the TOTP secrets backed up in Bitwarden, you can avoid this.

- Vault software can keep all of these secrets encrypted using keys protected by biometrics on a phone, or an external device like a Yubikey, that are only unwrapped by a particular physical interaction. Usually the vault software does a better job than the average person of determining whether you're looking at a legitimate authentication prompt or a phishing site, and I suspect it's less likely to automatically enter your TOTP code into the wrong than a person is when transcribing it by hand or copy pasting.

Re: TOTP Codes in the Terminal

#29

Post by sodality2 »

alwayslikethis wrote: post #13
sodality2 wrote: post #8

Earlier quoted context omitted.

For me it’s separation of secrets. If my vault is exposed they won’t be able to log in without the codes. Putting it all in one place is a bad idea, some may think.

What if you lost or somehow broke the phone? You'll be locked out your stuff faster than you'd expect. If you back it up to a cloud service, are you sure you can recover it without the TOTP? If you are backing it up to your computer, then it's already on your computer and will probably be compromised when your vault is, so you might as well use your vault anyways.

I load my TOTP tokens into two phones, one that stays at home fully charged. If I lose them, I can easily reset my TOTP with any reasonable provider - I have the account login and password, and can authenticate with my email/provide proof of identity.
Post reply on HN