Coder Social home page Coder Social logo

csyezheng / a2fa Goto Github PK

View Code? Open in Web Editor NEW
122.0 122.0 18.0 70 KB

a2fa is a command line tool for generating and validating one-time password. Its purpose is to get rid of phones and be able to authenticate easily.

License: Apache License 2.0

Go 90.40% Shell 4.37% PowerShell 5.23%
2fa authenticator hotp oath otp totp two-factor-authentication

a2fa's People

Contributors

csyezheng avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

a2fa's Issues

encrypting the shared keys

Use case:

One-time passwords can be easily calculated if the secret key is compromised

Proposal:

It is recommend to encrypt the shared secrets

Current behaviour:

Currently secret keys are stored in clear text in the database.

Desired behaviour:

Storing the keys securely by encrypting them with tamper-resistant hardware encryption

Alternatives considered:

Using the user’s password to encrypt the secret keys

a2fa list results in random number of records listed

Steps to reproduce

Run with argument "list" multiple times

Expected behaviour

All records displayed

Actual behaviour

Random records displayed
image

Environment info

linux Ubuntu / Windows 11

Proposed fix: (confirmed to work locally)
Alter cmd/commands/list.go listAccounts

When the append(result, otpView{...}) line of code is run concurrently from multiple goroutines, they all try to write to the result slice at the same time which results in some writes being lost.
Solution: synchronize access to the result slice by wrapping the section in a mutex

example:

var wg sync.WaitGroup
var mu sync.Mutex
for _, account := range accounts {
	wg.Add(1)
	go func(account models.Account) {
		defer wg.Done()
		code, err := account.OTP()
		if err != nil {
			log.Printf("%s %s generate code error%s\n", account.AccountName, account.Username, err)
		} else {
			mu.Lock() // start critical section
			result = append(result, otpView{
				accountName: account.AccountName,
				userName:    account.Username,
				code:        code,
			})
			mu.Unlock() // end critical section
		}
	}(account)
}...`

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.