anon/gauth

Go to file

M. J. Fromberger 8e211fc2dd Convert CI from Travis to GitHub Actions.

The performance of GitHub Actions is faster and more consistent than the free
tier of Travis CI. Build, lint, tests, and staticcheck for the same versions of
Go using Actions instead.

2020-10-29 16:05:23 -04:00

.github/workflows

Convert CI from Travis to GitHub Actions.

2020-10-29 16:05:23 -04:00

gauth

Fix padding removal when decrypting a config file. (#36 )

2020-10-26 18:42:15 -07:00

gauth.go

Fix padding removal when decrypting a config file. (#36 )

2020-10-26 18:42:15 -07:00

go.mod

Fix padding removal when decrypting a config file. (#36 )

2020-10-26 18:42:15 -07:00

go.sum

Fix padding removal when decrypting a config file. (#36 )

2020-10-26 18:42:15 -07:00

PKGBUILD

Added PKGBUILD for AUR on Archlinux

2014-10-16 22:16:21 -07:00

README.md

Update README.md (#12 )

2018-01-10 00:59:40 -08:00

README.md

gauth: replace Google Authenticator

Installation

With a Go environment already set up, it should be as easy as go get github.com/pcarrier/gauth.

Eg, with GOPATH=$HOME/go, it will create a binary $HOME/go/bin/gauth.

Usage

In web interfaces, pretend you can't read QR codes, get a secret like hret 3ij7 kaj4 2jzg instead.

Store one secret per line in ~/.config/gauth.csv, in the format name:secret. For example:

  AWS:   ABCDEFGHIJKLMNOPQRSTUVWXYZ234567ABCDEFGHIJKLMNOPQRSTUVWXYZ234567
  Airbnb:abcd efgh ijkl mnop
  Google:a2b3c4d5e6f7g8h9
  Github:234567qrstuvwxyz

Restrict access to your user:
```
  $ chmod 600 ~/.config/gauth.csv
```

Run gauth. The progress bar indicates how far the next change is.

  $ gauth
             prev   curr   next
  AWS        315306 135387 483601
  Airbnb     563728 339206 904549
  Google     453564 477615 356846
  Github     911264 548790 784099
  [=======                      ]

gauth is convenient to use in watch.
```
  $ watch -n1 gauth
```
Remember to keep your system clock synchronized and to lock your computer when brewing your tea!

Encryption

gauth supports password-based encryption of gauth.csv. To encrypt, use:

    $ openssl enc -aes-128-cbc -md sha256 -in gauth.csv -out ~/.config/gauth.csv
    enter aes-128-cbc encryption password:
    Verifying - enter aes-128-cbc encryption password:

gauth will then prompt you for that password on every run:

    $ gauth
    Encryption password: 
               prev   curr   next
    LastPass   915200 479333 408710

Note that this encryption mechanism is far from ideal from a pure security standpoint. Please read OpenSSL's notes on the subject.

Compatibility

Tested with:

Airbnb
Apple
AWS
DreamHost
Dropbox
Evernote
Facebook
Gandi
Github
Google
LastPass
Linode
Microsoft
Okta (reported by Bryan Baldwin)
WP.com
bittrex.com
poloniex.com

Please report further results to pierre@gcarrier.fr.

Rooted Android?

If your Android phone is rooted, it's easy to "back up" your secrets from an adb shell into gauth.

# sqlite3 /data/data/com.google.android.apps.authenticator2/databases/database \
          'select email,secret from accounts'

Really, does this make sense?

At least to me, it does. My laptop features encrypted storage, a stronger authentication mechanism, and I take good care of its physical integrity.

My phone also runs arbitrary apps, is constantly connected to the Internet, gets forgotten on tables.

Thanks to the convenience of a command line utility, my usage of 2-factor authentication went from 3 to 10 services over a few days.

Clearly a win for security.