TOTP authentication with free software

One-time passwords (OTPs) are increasingly used as a defense against phishing and other password-stealing attacks, usually as a part of a two-factor authentication process. Perhaps the most commonly used technique is sending a numeric code to a phone via SMS, but SMS OTPs have security problems of their own. An alternative is to use time-based one-time passwords (TOTPs). The normal TOTP situation is to have all of the data locked into a proprietary phone app, but it need not be that way.

The TOTP approach is simple enough; it starts with a secret shared between the client and server sides. The algorithm used to generate an OTP starts by looking at the current time, usually quantized to a 30-second interval. That time is combined with the secret, hashed, and used to generate a six-digit code that is used as the password. Both the client and server sides will generate a code at authentication time; if the client can provide the same code that the server calculates, then authentication succeeds. The code can only be used once and, in any case, is only valid for a short period.

TOTP can thus be used to prove possession of the shared secret at a specific point in time. It is convenient because it requires no special hardware; anything with a CPU and an accurate clock can generate a TOTP. On the client side, one program can be used to manage TOTPs for any number of sites. Users tend to default to proprietary phone apps like Google Authenticator, but there are some clear downsides to doing so. Among those are the unwise nature of trusting proprietary code with identity information and the pain that comes with losing the device running the app. In the free-software world, there should be a better way.

TOTP apps

A quick look on F-Droid turns up a number of free TOTP apps. Your editor gave two of them a try.

The first of those is Aegis, a fairly complete app for TOTP authentication. At the outset, Aegis wants to configure authentication — to the app itself. TOTP secrets are stored encrypted and are not accessible without providing a password to the app every time it starts. Aegis can also use the fingerprint sensor for authentication, which speeds the process considerably, but it will annoyingly ask for the password anyway sometimes ("so you don't forget it"), usually when the user is in a hurry to log in somewhere and get something done.

TOTP secrets are arbitrary base32 strings and, thus, not much fun to type on a handset keyboard. Happily, most sites implementing TOTP have the ability to generate a QR code with the secret, and Aegis can use the camera to read them. As a result, adding new sites is easily done.

By default, Aegis will show a screen with all known sites, displaying the current OTP for each. Tapping on a given site will copy the code for pasting into a form somewhere else. It is possible to assign sites to groups, providing a single level of organization that can be useful when the number of sites gets large. There are also facilities for searching for sites, but if that is required just to obtain an access code the usability battle has already been lost.

Aegis has various features for importing and exporting of its data. The import screen is a wonder to behold, with support for a large number of other apps. There are a few formats available for export, including an Aegis-specific JSON format and plain text. The export file will be encrypted unless the user taps past a couple of warnings about how dangerous that can be — and another warning that an unencrypted export has been made endures on the main screen.

Another popular TOTP app is FreeOTP+, which is a fork of the FreeOTP app originally released (under the Apache2 license) by Red Hat. Superficially, FreeOTP+ is similar to Aegis, in that it presents a screen full of known accounts. It does not actually display the code for any given account until it has been tapped on, though. This app seemingly does not encrypt its secrets data; it can be configured to require authentication at startup before providing any codes, but does not do so by default.

Like Aegis, FreeOTP+ can read TOTP secrets from a QR code, easing the process of setting up new sites. The import and export options for FreeOTP+ are more limited than those supported by Aegis, but they will suffice to get data into or out of the app. There is no support for organizing accounts into groups. In the end, FreeOTP+ comes across as being less well developed than Aegis but, in truth, it is more than good enough to get this simple job done.

TOTP on the desktop

Authenticator apps are convenient, but some of us still use real computers and often want to access sites that way. Your editor, unlike his offspring, does not have a phone surgically implanted, so logging into a site can lead to a scramble to figure out where the damn phone is so that the code can be produced. It sure would be nice to be able to generate the code directly on the system that is used to access a site.

The pass password manager has a number of nice features, including its command-line orientation, use of GnuPG, and use of Git to store password information. It turns out that there is also an extension called pass-otp that can be used to generate TOTP codes for a site. Once the extension is installed, using it is just a matter of adding an otpauth://totp/ line to the file for the site in question; this line is most easily obtained from a plain-text export from one of the above-mentioned apps.

The new line can be anywhere in the file, so it can coexist with the existing (reusable) password that must be the first line. The pass otp command will generate the code at any given time, likely requiring the entry of the user's GnuPG key passphrase to do it; there is an option to copy it to the clipboard for easy pasting into a web form. One thing pass otp lacks is an indication of how long the generated code will be valid.

Pass provides everything that many of us need, but for people who are more graphically inclined, KeePassXC can also manage TOTPs. Enabling TOTP for a site is a matter of going into the edit screen, hitting "Advanced", then entering the otpauth://totp/ line in the provided place. After that, the application will show a little clock face that, when clicked on, will calculate and show the code. The application's documentation recommends storing TOTP data in a separate database from the one containing passwords, "possibly even on a different computer". Your editor would guess that this advice is not often followed.

Summary

Given the number of options available, there is almost no reason to use a proprietary TOTP app if one does not want to. Using free-software for this purpose makes TOTP authentication available on more systems and allows the user to keep the sensitive identity information under their own control. The ease of backing up data from these applications and importing it into to others means that the loss of a phone need not cause the loss of access to important accounts on the net. This is one area where free-software users are well provided for.

---

to post comments