Hacker News Reader

Comment by w8rbt | Hacker News Reader

Does oathtool take stdin? Last time I looked it did not. I keep my TOTP secrets PGP encrypted and pipe them to goathgen.

    $ gpg -d encrypted-secret.txt | goathgen

https://github.com/w8rbt/goathgen

View on HN

Funny you'd wrote a wrapper like that, too. I ended up making something in C that uses readpassphrase(3) [with -lbsd on Linux, but I haven't built it on a Linux machine in years] and zeroes the memory with explicit_bzero(3) as it goes out.

The keys come from a dedicated password manager that only stores TOTP secrets and the password manager wipes the clipboard.

All this happens on a physically separate machine.

Reply on news.ycombinator.com