SIDEBAR
»
S
I
D
E
B
A
R
«
Setting free a Google Authenticator TOTP secret
Nov 7th, 2017 by miki

Below you’ll find an illustrated guide for freeing the authentication mechanism used by the Google Authenticator app for Android or iPhone for use on your favorite device (anywhere an implementation is available). In fact the Authenticator is using a standards based 2FA (two factor authentication) scheme defined by OATH (Initiative for Open Authentication) and published in RFC6238 dubbed TOTP – Time-Based One-Time Password Algorithm (more Authenticator background and it’s basis HOTP).

This is a rather fine contraption but Google doesn’t advertise it very loudly being a standard instead locking the generated TOTP secret into a QR code that they will only imply are for use by their own Google Authenticator. That is not true as a host of alternative Android OTP apps are compatible and can read the QR codes as they are based upon the Authenticator’s legacy as an open source application which Google took private.

Retrieve Google Account QR Code

Login to your Google Account (maybe using the authenticator?) and go to Account -> Security -> Signin -> 2-step verification.

Locate the “Authenticator app” section and Click “CHANGE PHONE” (really “CHANGE TOTP SECRET”).

Screenshot from 2017-11-06 22-32-05

In my country’s locale, Danish, this is BTW mistranslated as “SKIFT TELEFONNUMMER” = change phone number);

Screenshot from 2017-11-07 00-50-06

You’ll now get a choice between either iPhone or Android, this will only affect the link to the app store shown on next screen which also contains the QR code, the one we are really after:

Screenshot from 2017-11-06 23-03-44

Right click the QR code image, select to save it and put it somewhere you can find it (~/Google_TOTP_QR.png might be sensible).

Get your tools right

Install the QR-code decoder zbar for extracting the TOTP secet from the image and the OATH toolkit oathtool for generating future TOTP passwords using it. On Debian/Ubuntu this can be done by installing the packages zbar-tools and oathtool.

 

$ sudo apt install zbar-tools oathtool

 

Now extract the otpauth URI (seems to be a Google thing) by passing the image file to zbarimg;

 

$ zbarimg ~/Google_TOTP_QR.png
 QR-Code:otpauth://totp/Google%3Auser%40domain.com?secret=pca7uyfht7f6mfs7oiec4aeavxaevish&issuer=Google
 scanned 1 barcode symbols from 1 images in 0.02 seconds

 

The URI contains all parameters to input into the TOTP algorithm for generating a password usable for 2FA authentication, notably the secret key in base32 format. Defaults are not mentioned in the URI and are not necessary to specify explicitly for oathtool. So for the above URI specifying only a secret, a password can be generated as such;

$ oathtool --totp --base32 pca7uyfht7f6mfs7oiec4aeavxaevish
 491293

“491293” being the password, having a default validity of 30 seconds (called step size because of the counter based nature of the HOTP behind it).

If your are interested in the defaults assumed by oathtool they can be viewed by supplying -v to it (missing );

$ oathtool --totp --base32 pca7uyfht7f6mfs7oiec4aeavxaevish -v
Hex secret: 7881fa60a79fcbe6165f72082e0080adc04aa247
Base32 secret: PCA7UYFHT7F6MFS7OIEC4AEAVXAEVISH
Digits: 6
Window size: 0
Step size (seconds): 30
Start time: 1970-01-01 00:00:00 UTC (0)
Current time: 2017-11-06 23:23:31 UTC (1510010611)
Counter: 0x30007F7 (50333687)

133339

 

Use & Behold

Enjoy having cut your reliance on the Google Autenticator, and opened up for your own choice of client:

Also see the dongleauth.info website for a list of other sites supporting TOTP and U2F.

Clean Up & Secure

Be sure to delete the QR code image when finished, and seek out a suitably secure place to store your TOTP secret. One solution could be using PGP encryption, maybe even through some clever management system such as pass.

Also educate yourself of the shortcomings of TOTP/HOTP and consider studying and using the FIDO U2F standard and related devices.

HTC One Stagefright disable instructions
Jul 29th, 2015 by miki

Until your device is sufficiently patched against the Stagefright vulnerabilty I recommend disabling automatic MMS retrieval on any Android phones from 2.2 and up (which is hopefully all in current use) to prevent unattended triggering.

Howtos for Google and Samsung devices are here.

Below are screenshots of how to do it on HTC One M7 using the stock (HTC Sense) messaging application called “SMS”. The procedure is likely to be very similar on most HTC devices using Sense.
The UI shown is in Danish locale, the English menus will be something like SMS->Settings->Multi Media Messages (MMS)->Automatic Retrieval.

wpid-wp-1438164382994.jpeg wpid-wp-1438164394794.jpeg wpid-wp-1438164402504.jpeg

Schneier discusses details here and this seems to be the commit in CyanogenMod for the underlying problem in the media library. Check aælso the issue’s review page

Google Play; no interaction with policy breaking app provider
Aug 8th, 2012 by miki

When dealing with policy enforcement for products that you distribute from business partners and whose sales your organization directly profits from, you’d think that you’d want to engage in some kind of communication with your peers before making drastic moves like shutting down distribution of these products. Especially when your peer is a national lottery organization partly owned by a European state, who is strictly professional about their business and which probably has a non-significant turnover facilitated by the product.

Well, if your are Google and runs the Google Play software distribution system for the Android platform, you apparently couldn’t care less. At least that is what a move today by Google implies, when banning an Android gaming app by Danske Spil, the national Danish lottery, who has a governement enforced monopoly on lottery in Denmark. This was done without any interaction with Danske Spil which of course was taken by surprise when realizing this, as reported (GTrans) by Danish tech magazine Version2.

Admittedly, as it stands now from an objective point of view, the app clearly breaks the content policy of Google Play which states that “We don’t allow content or services that facilitate online gambling”. So the real question, apart from the peculiar  behaviour of Google towards this app provider for Google Play, is for Danske Spil; “How on earth did you think you could distribute an app through Google Play which so blatantly is in direct violation of the content policy?”.

Maybe the endorsement by the Danish legislation has risen to their heads, making them think their monoploy in Denmark made them so special that they could ignore Google’s standard policies? The current response from Danske Spil is that the app had been previously “approved” by Google, whatever that means because to my knowledge there is no verification procedure as such for content on Google Play (that’s a point for further investigation when time permits) .

At the moment not only the app itself, but also the provider page for Danske Spil A/S is inaccessible at Google Play, even though marketing from Danske Spil still tries to lure new users to the lotteries provided by the app, both from the web, TV and electronic billboards.

If your business model relies on outside partners (and which doesn’t?), this might be a good occasion to take the time for a second thought about what dependencies it has. And especially who is in the power to pull the carpet below it without interacting with you.

If I had a business with parts, components or services not under my in complete control, I’d prefer a partner which had a fellow human representing him, with which I could meet and look into his eyes. That way a social bond is created, which hopefully increases the probability that I will know if anything is about to happen that affects my business.

»  Substance:WordPress   »  Style:Ahren Ahimsa
© 2016 Mikini Services