Re: [Passwordsafe-linux] Thoughts on TOTP/HOTP support in PasswordSafe?
Mark McGuill <[email protected]> Fri, 4 Oct 2019 13:51:11 +0100
| Newsgroups | gmane.comp.security.passwordsafe.devel |
|---|---|
| Message-ID | <CAHb=2jfCw_OUW6234OEMF3qT5nbbzq6cHhZgvq015VXhsmK91A@mail.gmail.com> |
--===============7959045407714800638== Content-Type: multipart/alternative; boundary="000000000000991afb0594152a40" --000000000000991afb0594152a40 Content-Type: text/plain; charset="UTF-8" Hi there, I've done a bit of work on this for my app (Strongbox) which supports KeePass and Password Safe. In the KeePass windows world people used plugins to manage this feature. It has proven to be popular and has been made native in KeePassXC (A cross platform KeePass client) and also in my own app. I'd be happy to help with any queries you have. Currently if a user adds a TOTP via my app to their Password Safe database I support this by appending an OTPAUTH url to their notes field (less than ideal but functional). To answer one of the questions raised above: - Are the specs for the various authenticators out there (Authy, Google Authenticator, etc.) publicly available and usable to implement a clone in pwsafe? Yes (the standard is RFC 6238) Other things to think about off the top of my head for anyone looking to implement this: - Parameters are often required (Hash Algorithm (usually SHA1), Number of Digits (usually 6), Period (usually 30 seconds)) - OTPAUTH urls could be supported, they combine the parameters, the seed and some metadata like the Issuer, Name, Username and look like: otpauth://totp/ ACME%20Co:[email protected]?secret=HXDMVJECJJWSRB3HWIZR4IFUGFTMXBOZ&issuer=ACME%20Co&algorithm=SHA1&digits=8&period=31 They are usually scanned from a QR Code. - Some people use a variant of the standard RFC 6238 algo for use with "Steam" tokens, a gaming provider. FWIW, this is handled in the KeePass world by using "Custom Fields", basically a feature that allows for a set of Key-Value Pairs. I don't believe the equivalent exists in the Password Safe world and you might not want to go that route anyway, but in short a TOTP configuration can be added to any entry alongside a regular password. Hope that's helpful. Best, -Mark On Fri, 4 Oct 2019 at 09:07, pwsafe.org <[email protected]> wrote: > Hi Tom, > > I think that Bill meant adding one time password support for > different sites, not for authenticating PasswordSafe itself using TOTP/HOTP. > > Yubikey is currently supported, including the ability to configure a > backup device as you described. > > Rony > > On Fri, Oct 4, 2019 at 7:38 AM Tom Mitchell <[email protected]> wrote: > >> On Thu, Oct 3, 2019 at 8:55 PM Bill Blough via Passwordsafe-linux >> <[email protected]> wrote: >> > >> > Hi all, >> > >> > I've been considering implementing TOTP/HOTP support in PasswordSafe. >> >> It seems possible and interesting but I would rather add YubiKey support >> first. >> One weakness with password managers is key management for the password >> manger >> software itself. Two YubiKey device support please. A pair of >> YubiKey devices allows a second device to be >> kept in a sealed tamper evident envelop of the managers or company >> office safe. The encrypted password-safe file >> can be replicated as needed for portability. >> >> One problem with the Google and Microsoft Authentication is they are >> tied to devices that >> are easy to misplace and also have fragile to strong unlock features. >> They are useful. >> >> >> >> -- >> T o m M i t c h e l l ( o n N i f t y E g g ) >> >> >> _______________________________________________ >> Passwordsafe-linux mailing list >> [email protected] >> https://lists.sourceforge.net/lists/listinfo/passwordsafe-linux >> > > > -- > Ubi dubium, ibi libertas (where there is doubt, there is freedom) > _______________________________________________ > Passwordsafe-devel mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/passwordsafe-devel > --000000000000991afb0594152a40 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr"><div>Hi there,</div><div><br></div><div>I've done a bi= t of work on this for my app (Strongbox) which supports KeePass and Passwor= d Safe. <br></div><div><br></div><div>In the KeePass windows world people u= sed plugins to manage this feature. It has proven to be popular and has bee= n made native in KeePassXC (A cross platform KeePass client) and also in my= own app.</div><div><br></div><div>I'd be happy to help with any querie= s you have. Currently if a user adds a TOTP via my app to their Password Sa= fe database I support this by appending an OTPAUTH url to their notes field= (less than ideal but functional).<br></div><div><br></div><div>To answer o= ne of the questions raised above:</div><div><br></div><div>- Are the specs = for the various authenticators out there (Authy, Google=20 Authenticator, etc.) publicly available and usable to implement a clone=20 in pwsafe?</div><div>Yes (the standard is RFC 6238)<br></div><div><br></div= ><div>Other things to think about off the top of my head for anyone looking= to implement this:</div><div><br></div><div>- Parameters are often require= d (Hash Algorithm (usually SHA1), Number of Digits (usually 6), Period (usu= ally 30 seconds))</div><div>- OTPAUTH urls could be supported, they combine= the parameters, the seed and some metadata like the Issuer, Name, Username= and look like:</div><div><br></div><div>otpauth://totp/<a href=3D"http://A= CME%20Co:[email protected]?secret=3DHXDMVJECJJWSRB3HWIZR4IFUGFTMXBOZ&i= ssuer=3DACME%20Co&algorithm=3DSHA1&digits=3D8&period=3D31">ACME= %20Co:[email protected]?secret=3DHXDMVJECJJWSRB3HWIZR4IFUGFTMXBOZ&issu= er=3DACME%20Co&algorithm=3DSHA1&digits=3D8&period=3D31</a></div= ><div><br></div><div>They are usually scanned from a QR Code.</div><div><br= ></div><div>- Some people use a variant of the standard RFC 6238 algo for u= se with "Steam" tokens, a gaming provider.</div><div><br></div><d= iv>FWIW, this is handled in the KeePass world by using "Custom Fields&= quot;, basically a feature that allows for a set of Key-Value Pairs. I don&= #39;t believe the equivalent exists in the Password Safe world and you migh= t not want to go that route anyway, but in short a TOTP configuration can b= e added to any entry alongside a regular password.<br></div><div><br></div>= <div>Hope that's helpful.</div><div><br></div><div>Best,</div><div>-Mar= k<br></div></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"g= mail_attr">On Fri, 4 Oct 2019 at 09:07, <a href=3D"http://pwsafe.org">pwsaf= e.org</a> <<a href=3D"mailto:[email protected]">[email protected]</a>> = wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0= px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir= =3D"ltr"><div class=3D"gmail_default" style=3D"font-size:small">Hi Tom,</di= v><div class=3D"gmail_default" style=3D"font-size:small"><br></div><div cla= ss=3D"gmail_default" style=3D"font-size:small">I think that Bill meant addi= ng one time password support for different=C2=A0sites, not for authenticati= ng PasswordSafe itself using TOTP/HOTP.</div><div class=3D"gmail_default" s= tyle=3D"font-size:small"><br></div><div class=3D"gmail_default" style=3D"fo= nt-size:small">Yubikey is currently supported, including the ability to con= figure a backup device as you described.</div><div class=3D"gmail_default" = style=3D"font-size:small"><br></div><div class=3D"gmail_default" style=3D"f= ont-size:small">Rony</div></div><br><div class=3D"gmail_quote"><div dir=3D"= ltr" class=3D"gmail_attr">On Fri, Oct 4, 2019 at 7:38 AM Tom Mitchell <<= a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]</= a>> wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0p= x 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On= Thu, Oct 3, 2019 at 8:55 PM Bill Blough via Passwordsafe-linux<br> <<a href=3D"mailto:[email protected]" target=3D"_= blank">[email protected]</a>> wrote:<br> ><br> > Hi all,<br> ><br> > I've been considering implementing TOTP/HOTP support in PasswordSa= fe.<br> <br> It seems possible and interesting but I would rather add YubiKey=C2=A0 supp= ort first.<br> One weakness with password managers is key management for the password mang= er<br> software itself.=C2=A0 Two YubiKey device support please.=C2=A0 =C2=A0A pai= r of<br> YubiKey=C2=A0 devices allows a second device to be<br> kept in a sealed tamper evident envelop of the managers or company<br> office safe. The encrypted password-safe file<br> can be replicated as needed for portability.<br> <br> One problem with the Google and Microsoft Authentication=C2=A0 is they are<= br> tied to devices that<br> are easy to misplace and also have fragile to strong unlock features.<br> They are useful.<br> <br> <br> <br> -- <br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 T o m=C2=A0 =C2=A0 M i t c h e l l ( o n= =C2=A0 =C2=A0N i f t y E g g )<br> <br> <br> _______________________________________________<br> Passwordsafe-linux mailing list<br> <a href=3D"mailto:[email protected]" target=3D"_blan= k">[email protected]</a><br> <a href=3D"https://lists.sourceforge.net/lists/listinfo/passwordsafe-linux"= rel=3D"noreferrer" target=3D"_blank">https://lists.sourceforge.net/lists/l= istinfo/passwordsafe-linux</a><br> </blockquote></div><br clear=3D"all"><div><br></div>-- <br><div dir=3D"ltr"= ><div dir=3D"ltr"><span style=3D"font-size:12.8px">Ubi dubium, ibi libertas= (where there is doubt, there is freedom)</span><br></div></div> _______________________________________________<br> Passwordsafe-devel mailing list<br> <a href=3D"mailto:[email protected]" target=3D"_blan= k">[email protected]</a><br> <a href=3D"https://lists.sourceforge.net/lists/listinfo/passwordsafe-devel"= rel=3D"noreferrer" target=3D"_blank">https://lists.sourceforge.net/lists/l= istinfo/passwordsafe-devel</a><br> </blockquote></div> --000000000000991afb0594152a40-- --===============7959045407714800638== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============7959045407714800638== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Passwordsafe-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/passwordsafe-devel --===============7959045407714800638==--