pass-otp VS two-factor-auth

otp tokens are included in the encrypted file. It’s just appended to the file, e.g. otpauth://totp/… You’ll need to install https://github.com/tadfisher/pass-otp on desktop for this to work. But the android client comes with support builtin.

I use pass myself. I had no idea you could use it for otp. Are you using something like this? https://github.com/tadfisher/pass-otp

I use https://github.com/tadfisher/pass-otp with pass, which has a FOSS client for desktop and smartphone (at least for andriod, no idea for ios)

There are the password manager pass (https://www.passwordstore.org/), which has an extension pass-otp (https://github.com/tadfisher/pass-otp). This extension can be used instead of Google Authenticator.

> In particular, I don't see how 2FA is possible with this

Umm, why not?

First, you can use a different app (like aegis) to generate OTPs.

Second, pass has an extension (https://github.com/tadfisher/pass-otp) that can be used to generate OTPs.

git clone https://github.com/tadfisher/pass-otpcd pass-otpsudo make install

You can use pass

It's really easy to integrate into websites as well. I did so a few years ago. The TOTP algorithm is just a few lines of code. I adapted this implementation https://github.com/j256/two-factor-auth at the time. There are similar libraries available for lots of languages.

You need a library like that and a way to convert an otp:// url into a QR code, for which there are many libaries as well. The rest is just implementing a sane UX around this. Storing the user's TOTP secret server side is a bit tricky. I suspect a plain text field in a database is quite common for this; which of course would be disastrous if that database were ever stolen. Secret stores don't scale for this as they tend to be designed for just a handful of secrets. We ended up encrypting these totp secrets using a key from our secret store.