Hacker News Reader

Yes I think I used vpnc for Sheffield a few years ago.

If, like Sheffield, they also require Duo, it is possible to use that without a phone or hardware token by extracting the HOTP secret from a real or fake phone/tablet registration. It's probably also possible to use that automatically with a free VPN client, like for ssh, but I've never bothered to try making it work.

View on HN

I go to Loughborough University and we have Anyconnect with Duo. I use OpenConnect for the VPN and I wrote a little Rust tool[1] to extract the HOTP secret and use FreeOTP to generate the codes [since Bitwarden seems to only have TOTP, not HOTP :/]

[1]: https://github.com/videogame-hacker/duo-hotp-export

I found https://f-droid.org/en/packages/net.scintill.duotp and https://github.com/simonseo/nyuad-spammer/blob/master/spamme... only after extracting the secret from a throwaway Duo app's storage.

Reply on news.ycombinator.com