gauth VS google-authenticator

I use https://github.com/pcarrier/gauth

It relies on file permissions so is not exactly robustly secure (no idea about RAM vulnerabilities etc).

As per the author, I consider my laptop the fundamental point of vulnerability. If someone else gets access to it, I'll know and I'll hit the metaphorical panic button :)

I was able to take a screenshot of GAuth backups on iPhone using the button hotkeys(IE: Power+Volume up). I setup a container that runs a go version of GAuth and used a python script to decrypt the (decrypted QR code) backup keys. Then I backed up the encrypted keyfile to offline disk, encrypted the container backup and deleted it from the hypervisor.

https://github.com/pcarrier/gauth

https://github.com/scito/extract_otp_secret_keys

> A future without passwords

No, thank you, especially if Google is going to be the gatekeeper.

https://github.com/pcarrier/gauth FTW

otpauth:// is a de-factor standard, since Google Authenticator uses it: https://github.com/google/google-authenticator/wiki/Key-Uri-...

Random question if you're using TOTP why not just give the user the secret when signing up as a Google Authenticator URI encoded in a QR code? Then you won't need to futz around with sending it to them afterwards. You can even use a library like qrcode.js so you don't generate the barcode server side either.

Locker can generate Time Based OTP codes parsing TOTP urls stored under a special key named totp.

(Examples> https://github.com/google/google-authenticator/wiki/Key-Uri-Format)

If we're talking about the encrypted Authy TOTP secrets and IF they get cracked or guessed, Authy does store the email in the name of the item. Having the name, service and the secret within the QR code's URI is normal and the standard for TOTP. The only thing the hackers won't have is the password.