pass-otp VS google-authenticator

otp tokens are included in the encrypted file. It’s just appended to the file, e.g. otpauth://totp/… You’ll need to install https://github.com/tadfisher/pass-otp on desktop for this to work. But the android client comes with support builtin.

I use pass myself. I had no idea you could use it for otp. Are you using something like this? https://github.com/tadfisher/pass-otp

I use https://github.com/tadfisher/pass-otp with pass, which has a FOSS client for desktop and smartphone (at least for andriod, no idea for ios)

There are the password manager pass (https://www.passwordstore.org/), which has an extension pass-otp (https://github.com/tadfisher/pass-otp). This extension can be used instead of Google Authenticator.

> In particular, I don't see how 2FA is possible with this

Umm, why not?

First, you can use a different app (like aegis) to generate OTPs.

Second, pass has an extension (https://github.com/tadfisher/pass-otp) that can be used to generate OTPs.

You can use pass

I also use this for OTP tokens instead of my phone!

https://github.com/tadfisher/pass-otp

generate OTP if pass-otp is installed (although I'm not sure if generating OTPs on the same device where you have your passwords is a good idea)

Locker can generate Time Based OTP codes parsing TOTP urls stored under a special key named totp.

If we're talking about the encrypted Authy TOTP secrets and IF they get cracked or guessed, Authy does store the email in the name of the item. Having the name, service and the secret within the QR code's URI is normal and the standard for TOTP. The only thing the hackers won't have is the password.

You can get string value otpauth://totp/otp_example?secret=NBSWY3DP from QR code. This formt is defined in [Google Authenticator Key Uri Format].(https://github.com/google/google-authenticator/wiki/Key-Uri-Format)

You only need to pass the parameters from the Key Uri.

In this scenario, we'll use third-party libraries such as Google Authenticator, Axios, and dotenv. Users will be able to authenticate themselves using Google, send requests to REST endpoints using Axios, and preserve secret API keys using dotenv.

TOTP/HOTP codes are defined by an algorithm (sha1/md5/...), secret (A826EF8...), and number of digits (I usually see 6 digit codes). TOTP additionally takes time as a parameter (ex: it changes every 30 seconds) and HOTP takes a counter as a parameter. All of these parameters go into the function to generate the numbers as a result.

If you have ever set one of these up with a QR code, that QR scans to something like: otpauth://totp/ACME%20Co:[email protected]?secret=HXDMVJECJJWSRB3HWIZR4IFUGFTMXBOZ&issuer=ACME%20Co&algorithm=SHA1&digits=6&period=30 (From: https://github.com/google/google-authenticator/wiki/Key-Uri-...)

So to directly answer your question: a backup would in some way contain all the parameters above, possibly in that otpauth:// format, but could be json or something else.

I would not consider Authy to be a trustworthy backup. I assume they are storing these secrets for you and transferring them to other computers at your request. If you can't see the secret, you can't switch to a different app. (Take this last paragraph with a grain of salt, I don't know much about authy but it sounds like trouble. I use FreeOTP and other open source OTP apps).

https://github.com/google/google-authenticator/wiki/Key-Uri-...

That's the format that gets encoded into the QR code. If you can decode the QR code you can get the secret key easily.

They are both TOTP or HOTP (based on the type passed in the otpauth uri, defaulting to type=totp algorithm=sha1 digits=6)