Hacker News Reader

Comment by distcs | Hacker News Reader

Is there some Unix-ish tool to generate these TOTPs on a laptop? I don't like to keep the 2nd factor on a small mobile device that is easy to lose. So I ask about a laptop tool.

By Unix-ish I mean something that is small and does one thing well. Like pipe in a secret to it and it gives me a TOTP? Pipe in multiple secrets and it gives me multiple TOTPs? Then I don't have to remain beholden to a custom encryption format. I can encrypt my secrets with other Unix-ish tools, decrypt it, pipe it to this tool and get my TOTPs. Recommendations?

View on HN

pass-otp[0] integrates into pass[1] nicely. It's about as unix-y as password/secret management comes in my eyes.

Alternatively, gopass[2], which re-implements pass in golang, has this functionality built in[3].

[0] https://github.com/tadfisher/pass-otp

[1] https://www.passwordstore.org/

[2] https://www.gopass.pw/

[3] https://github.com/gopasspw/gopass/blob/master/docs/commands...

Thanks for the compliment!

Also use browserpass to integrate pass with Firefox/etc:

https://github.com/browserpass/

Also need to mention totp.app

It allows export import feature of keys

I just cooked up something in Python if you have it installed on your system, quite straightforward to use. If there's interest, I can prepare a compiled version.

Unlike the other ones posted here, this one just takes secrets as arguments:

    > python -mtotp DGLTPWEUERUUDCEC SWPKQCKEWRXPCRXE
    628502
    674329

https://pastebin.com/apNKxMBF

I believe it is worth mentioning here that reading secrets from command line arguments exposes the secrets in shell history (e.g., ~/.bash_history, ~/.zsh_history, etc.), thus writing the secrets in cleartext to the filesystem. If command line auditing is enabled on a system, any secrets in command line arguments would be exposed in such audit logs too.

Further, if multiple users are logged into the same system (perhaps an unlikely scenario for most people), then secrets in command line arguments would expose the secrets in the output of ps -ef too thereby exposing the secrets to other users.

By the way, I have a similar script at https://github.com/susam/mintotp but it reads secrets from the standard input (as opposed to reading from command line arguments), one secret per line, and outputs TOTP values, one per line. Most of what this script does can be done with oathtool too and there is a section titled "Alternative: OATH Toolkit" in the README that documents this in detail.

fun fact: you can teach your shell to ignore commands that begin with a space character. in bash $HISTCONTROL needs to be ignorespace or ignoreboth, in zsh you must setopt HIST_IGNORE_SPACE

> reading secrets from command line arguments exposes the secrets in shell history

Yes, and process arguments (such as from command line) can also be accessible in process list data that's accessible to other processes and users.

Even if the process only lives for an instant, or normally no other processes could access the data, good practice is to nevertheless keep secrets out of any process arguments.

I should indeed have mentioned that. On the other hand, this is not a concern if you do not execute the it outside your shell (e.g. in another script that reads TOTP secrets from elsewhere).

You are looking for a Yubikey and `ykman`.

This is secure because the secret never leaves the hardware key.

This is convenient because you launch a tool with a global keyboard shortcut and copy/paste the code. I use `yubikey-oath-dmenu` to allow me to quickly filter to the TOTP code I need.

Several options...

Not exactly the same, but if you're using Bitwarden (which is compatible with generating TOTP tokens) to manage your passwords, you can use their bitwarden-cli tool to request tokens from the cli: https://bitwarden.com/help/cli/#get

But if you want the simplest cli thing, you can probably can use this golang ( https://github.com/yitsushi/totp-cli ) or this python ( https://github.com/WhyNotHugo/totp-cli ) implementations.

From today! https://drewdevault.com/2022/10/18/TOTP-is-easy.html

> Is there some Unix-ish tool to generate these TOTPs on a laptop? I don't like to keep the 2nd factor on a small mobile device that is easy to lose.

I know that this is not really answering your question, but most open-source TOTP apps (like andOTP and Aegis) can export all the TOTP in an encrypted file that you can save. So if you lose your main TOTP device you can restore all of them quite easily.

https://keepassxc.org comes with keepassxc-cli

You can also store them on YubiKeys, accessible on the command line with ykman.

I use https://github.com/pcarrier/gauth

It relies on file permissions so is not exactly robustly secure (no idea about RAM vulnerabilities etc).

As per the author, I consider my laptop the fundamental point of vulnerability. If someone else gets access to it, I'll know and I'll hit the metaphorical panic button :)

Edit: I recently set up a new laptop, and copied my OTP seeds from Aegis into gauth without a hitch. Another step closer to me moving away from Authy.

I think you want oathtool.

You can also use python's pyotp.totp.now()

https://earthly.dev/blog/multi-factor-auth/

You need a TPM 2.0 compatible CPU, but something like this sounds really excellent: https://github.com/tpm2-software/tpm2-totp

This means your laptop itself would be your hardware device, the TOTP secret would be stored in the TPM and theoretically impossible to steal/copy. Of course this means you will probably want a mobile device (possibly a second laptop also) as a backup.)

Note that tpm2-totp is specifically meant to authenticate your laptop's state (TPM PCR values) to you, not you to some third system. But you could adapt tpm2-totp for the purpose of authenticating you to other systems.

Here's an example of how you can wrap oathtool from oath-toolkit: https://markusholtermann.eu/2018/08/simple-bash-totp-script/

https://www.nongnu.org/oath-toolkit/

OATH Tookit provides console tool for generating TOTP codes: oathtool. https://www.nongnu.org/oath-toolkit/

https://github.com/WhyNotHugo/totp-cli

Authy used to have a Chrome client you can run on your computer that syncronizes all your secrets.

Totp.app is a great web app. So you can install on your phone as well

Reply on news.ycombinator.com