3

consider the following situation

  • I have an account at https://www.mercadolibre.com.ar. According to a new policy on login, I am asked to provide a six digits Google Authenticator code;
  • I have installed google-authenticator on my Linux (Fedora) machine;
  • I do not want to use any smartphone, or any Android/IOS app.

Do I have a way to generate the six digits code?

6
  • Google Chrome has an authenticator app (chrome.google.com/webstore/detail/authenticator/…). If that is what you mean?
    – BadSkillz
    Sep 23, 2021 at 9:58
  • Hi, I am not sure. How does it work? What am I supposed to do?
    – mario
    Sep 23, 2021 at 10:03
  • I mean, do I need a secret key from the web site I wish to log in?
    – mario
    Sep 23, 2021 at 10:11
  • The website (or service) you want to use TOPT for usually generates a QR code you can scan (or select with the chrome extension), you then provide the service with 3 consecutive codes to prove it works. But I suggest you google on how to activate TOTP as this is not a question that should be answered here imo.
    – BadSkillz
    Sep 23, 2021 at 10:47
  • 1
    It looks like you want to know how to use the google-authenticator app on Linux. The app's documentation or man page should tell you how to set it up. Else this is a SuperUser question.
    – schroeder
    Sep 25, 2021 at 8:09

4 Answers 4

2

You are required to use TOTP, and Google Authenticator is a common application to generate them. You aren't required to use it, you can use other programs.

TOTP uses a secret (not a key) to generate the 6 digit codes, and those codes change every 30 seconds. Basically it's a hash of the timestamp (in 30 second intervals) plus the secret, and converted to a 6-digit number.

For example, your password manager can generate the codes as well. If you aren't using a password manager, start using one right now. So ask your favorite search engine about a good password manager, install one, and use it to store the TOTP secret.

If you want to generate them yourself, you can do it in PHP, Python, Perl, Ruby, Go, Java... There's a lot to choose from.

1
  • 1
    I can highly recommend KeepassXC for this purpose.
    – MechMK1
    Sep 23, 2021 at 11:20
2

I had a similar need for 2FA on my Linux machine. While there are many ways to implement TOTP, the one I chose was Twilio Authy.

Twilio Authy

It's easy to use and supports multiple 2FA accounts. It's also available as a SNAP install.

2

There is no need to install a program on your system to generate OTP's. Here's a nifty web page that you can use to generate OTP's (HOTP or TOTP) using just your web browser. The crypto is done client-side (or in-browser) in javascript, so the secret never leaves your browser:

https://khovansky.me/demos/web-otp/

0

I was in a similar situation: My employer required TOTP for some purposes and I refused to acquire a smart phone for this. I found a solution. It wasn't pretty and head of security would have gone ballistic if they got word of it, but fortunately they never did. Here goes:

  1. memorize your secret
  2. write a program for TOTP-codes in your favorite language
  3. punch in the key whenever you need a one time code

My secret was just 32 characters, so it was just another password to remember. As for the one time code, the algorithm for TOTP is fairly simple and can be implemented in C or similar without much hassle. However, if you want it really simple, then you can even do this interactively in the python shell with available libraries:

In [1]: import pyotp

In [2]: key = 'reallysecretkeygoeshere'

In [3]: totp = pyotp.TOTP(key)

In [4]: totp.now()
Out[4]: '123456'

And that's it! Now, I feel the need to emphasize that this is a horrible solution which circumvents the entire purpose of the TOTP-scheme: If someone installs a key logger on your computer, observes what you type, tortures you, or even just browses through your machine if they get access to it, then they will get the secret - just as if it was a regular password, which is basically what the secret in the above case has been reduced to. If, however, the secret is properly installed on a yubikey or similar, then it cannot be recovered, ever. A correct code in those cases absolutely require physical control over a key. Ideally, you should therefore never even see your secret, and certainly not confine it to memory (or even worse, write it down). I did, and I certainly violated the trust of my employer by doing so. This might have been adequate reason to fire me, but I didn't particularly care and I was never caught. I can't say I recommend my solution, but it works.

5
  • 4
    Please don't. This seems fine at first, but isn't. Don't try to memorize TOTP secrets. You are supposed to enable TOTP on every site that supports it, and memorizing TOTP secrets don't scale well.
    – ThoriumBR
    Sep 23, 2021 at 10:26
  • Look, I know it's awful, but the scaling factor is really the least important drawback of my scheme. If I had been even less conscientious, I'd have stored the secret on a post-it note, but I felt some smidgeon of loyalty to the employer and memorized it instead. My solution works just fine with a plain text, you don't have to memorize the secret if you don't want to.
    – user2248727
    Sep 23, 2021 at 10:32
  • 1
    That's why you should really use a password manager. It will remember the secrets, generate the tokens, and encrypt the secrets for you.
    – ThoriumBR
    Sep 23, 2021 at 10:37
  • 1
    You know KeepassXC supports TOTP, right? That's a fully offline and open-source solution that is secure if handled correctly
    – MechMK1
    Sep 23, 2021 at 11:19
  • Yes, password managers are almost invariably better, simpler, safer and faster than memorizing secrets and creating codes by means of self written code. I don't deny any of this. In my specific case at work, I was not allowed to install keepass. There was exactly one allowed solution, and it required the possession of a smart phone. I didn't want to buy one, and my employer wouldn't give me one. Since my previous employer was unreasonable, I found the hackaround above. My way of subtly raising the middle finger if you like.
    – user2248727
    Sep 23, 2021 at 12:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .