Hacker News Reader

Quite common I believe [1], but typically Universities will not make their own VPN, but use some OTS component, and often those will have an open-source implementation if you would prefer to use that. If you're concerned, then only install the VPN on a VM and use that exclusively for accessing those services required.

[1] https://www.sheffield.ac.uk/departments/it-services/campus-o...

View on HN

Yes I think I used vpnc for Sheffield a few years ago.

If, like Sheffield, they also require Duo, it is possible to use that without a phone or hardware token by extracting the HOTP secret from a real or fake phone/tablet registration. It's probably also possible to use that automatically with a free VPN client, like for ssh, but I've never bothered to try making it work.

I go to Loughborough University and we have Anyconnect with Duo. I use OpenConnect for the VPN and I wrote a little Rust tool[1] to extract the HOTP secret and use FreeOTP to generate the codes [since Bitwarden seems to only have TOTP, not HOTP :/]

[1]: https://github.com/videogame-hacker/duo-hotp-export

I found https://f-droid.org/en/packages/net.scintill.duotp and https://github.com/simonseo/nyuad-spammer/blob/master/spamme... only after extracting the secret from a throwaway Duo app's storage.

Reply on news.ycombinator.com