keyfob

keyfob is a two-factor authentication agent suitable for AWS and Github. Works pretty much the same as Google Authenticator, but uses your laptop's keychain.

Usage:

go get -u github.com/StevenACoffman/keyfob

keyfob add [name] [key]
keyfob otp [name]
keyfob help

keyfob add name adds a new key to the keyfob keychain with the given name. It prints a prompt to standard error and reads a two-factor key from standard input. Two-factor keys are short case-insensitive strings of letters A-Z and digits 2-7.

The new key generates time-based (TOTP) authentication codes.

keyfob opt [name] prints a One Time Password (aka two-factor authentication) code from the key with the given name. If --clip is specified, keyfob also copies to the code to the system clipboard.

With no arguments, keyfob prints two-factor authentication codes from all known time-based keys.

The time-based authentication codes are derived from a hash of the key and the current time, so it is important that the system clock have at least one-minute accuracy.

The keychain is stored unencrypted in the text file $HOME/.keyfob.

Example

During GitHub 2FA setup, at the “Scan this barcode with your app” step, click the “enter this text code instead” link. A window pops up showing “your two-factor secret,” a short string of letters and digits.

Add it to keyfob under the name github, typing the secret at the prompt:

$ keyfob add github
keyfob key for github: nzxxiidbebvwk6jb
$

Then whenever GitHub prompts for a 2FA code, run keyfob to obtain one:

$ keyfob otp github
268346
$

Derivation

This is just a little toy cobbled together from 2fa, cobra, and go-keyring.

Unlike 2fa, this doesn't support listing all the stored codes, or adding 7 or 8 character long TOTP, or counter-based (HOTP) codes. Pillaging ... ehrm... adapting the 2fa code to do that in here would be easy, but I don't need it.

Really, does this make sense?

At least to me, it does. My laptop features encrypted storage, a stronger authentication mechanism, and I take good care of its physical integrity.

My phone also runs arbitrary apps, is constantly connected to the Internet, gets forgotten on tables.

Thanks to the convenience of a command line utility, I'm more likely to enable MFA in more places.

Clearly a win for security.

Dependencies

OS X

The OS X implementation depends on the /usr/bin/security binary for interfacing with the OS X keychain. It should be available by default.

Linux

The Linux implementation depends on the [Secret Service][SecretService] dbus interface, which is provided by GNOME Keyring.

It's expected that the default collection login exists in the keyring, because it's the default in most distros. If it doesn't exist, you can create it through the keyring frontend program Seahorse:

• Open seahorse
• Go to File > New > Password Keyring
• Click Continue
• When asked for a name, use: login