robbiev / two-factor-auth

Generate 2FA tokens compatible with Google Authenticator

Simple CLI app that generates tokens compatible with Google Authenticator. I implemented this mainly to understand how it works, you should probably not use this.

Example output:

$ go run main.go "<your key>"
934523 (17 second(s) remaining)

Relevant RFCs:

• http://tools.ietf.org/html/rfc4226
• http://tools.ietf.org/html/rfc6238

two-factor-auth's Issues

I don't know where the key is?

Warning: pasting the following URL into your browser exposes the OTP secret to Google:
https://www.google.com/chart?chs=200x200&chld=M|0&cht=qr&chl=otpauth://totp/hill@VM_0_5_centos%3Fsecret%3DBNPOY5S6VK3A3ML4R4OYFFJW6E%26issuer%3DVM_0_5_centos
Your new secret key is: BNPOY5S6VK3A3ML4R4OYFFJW6E
Your verification code is 427203
Your emergency scratch codes are:
30932611
86577771
96728177

[hill@TOVAOE2029 two-factor-auth]$ go run main.go BNPOY5S6VK3A3ML4R4OYFFJW6E
illegal base32 data at input byte 24
exit status 1

Question

Found your blog post about this. Just wondering, how do you check the 6 digit code is valid on the server side?

t

s

Base32 Decode or Encode

I see you're using "DecodeString". Is that intentionally or you it supposed to say "EncodeString"
key, err := base32.StdEncoding.DecodeString(inputNoSpacesUpper)

Thanks much

where is the key?

I am only a layman. i don,t know where the key is,
from the following parts. if the key is there？
$ cat /home/blc/liufeia/key
Warning: pasting the following URL into your browser exposes the OTP secret to Google:
https://www.google.com/chart?chs=200x200&chld=M|0&cht=qr&chl=otpa
Your new secret key is: 7QOJCMH2YGT
Your verification code for code 1 is 0942
Your emergency scratch codes are:
38106
appreciate

Manual Entry doesn't work

The ManualEntryKey doesn't work with the Google Authenticator app to create a new account. The key generated seems to be too short and in the incorrect format. The format expected is xxxx xxxx xxxx xxxx xxxx xxxx

How do you generate that style of key for use with manual entry?

Running on little endian machine

Will your code generate the correct OTPs on a little endian machine?

On snapchat

Does anyone know how to bypass 2FA? I don't have access to the number anymore