Vivokey Codes - TOTP authenticator utility for Linux

Actually it wasn’t. I took another look at your bug report on a faster machine and it still did it. Only it did it behind the scene with the new version I made this morning. Apparently when you mess around with the list programmatically, the “changed” callback gets called - not just when the user selects a row. So in fact, all the codes were being copied into the clipboard each time I would update the display :slight_smile:

Anyway, get the latest revision, it’s fixed now.

My pleasure.

1 Like

By the way I took the 4 install lines from the readme on github and dropped it into a shell file to automatically copy all the necessary files to where they need to go.

If you don’t mind my requesting a minor change. Could the spinner be set to appear only while the codes are active? I know it is one of those little nit picky things but it could make it a tiny bit more intuitive.

edit: I rather wish I had a good understanding of all this and how to make changes otherwise I would just send you a PR

There’s a reason the spinner is here all the time: it signals that while the main panel is up, vkman is being called over and over and burning CPU. The whole polling thing in the background ain’t pretty and it’s very inefficient. The idea behind the spinner is to remind the user that stuff is happening, and annoy them into closing the window - if the automatic idle timeout doesn’t close it for them after two minutes.

Well, it’s not a very long program and I try and comment my code as best as possible. It shouldn’t be too hard to grasp. There are some Python idiosyncrasies in it, but if you feel like having a go at changing it and submitting a PR, have at it.

1 Like

I’m sure I will but I’m not very adept at examining someone elses program and figuring out what I want to do. It just takes me a lot longer. My programming skill extends to small one-page scripts to do very specific things. That and working on a gui is something I’ve never done before. All new experiences :smiley:

Maybe a good opportunity to dip a toe into it? I find it much easier to dive into a subject I don’t know when I have something I want to do. And this particular application really is nothing complicated, the dependencies are kept to an absolute minimum, the UI is built programmatically the old fashion way… You really can’t get lost in that code.

4 Likes

I recoded the code reading bit to work natively without the Vivokey Manager utility, which means it’s a lot more efficient in terms of CPU, which means Vivokey Codes can now offer background reading: enable the option and the panel automatically comes up when Vivokey OTP codes are read successfully. No need to click on the tray icon to bring it up anymore.

Also, I added an option to automatically close the panel when a code is selected, meaning there’s no need to click to close it anymore either.

With those two new options, copy / pasting a 2FA code into an application now takes exactly 2 clicks. Check it out:

3 Likes

Cool app! I usually use the Yubikey Authenticator app though, which also runs on Linux and third-party PC/SC reader without issues. I forked Flex-OTP (the Vivokey OTP applet) and modified the AID to impersonate the YubiKey AID. Then it works great with all Yubikey apps. GitHub - StarGate01/Flex-OTP

This only works for Javacard-compatible tokens, so eg. the Apex.

More opensoure tools are good to see!

Yeah hacking the Yubikey Authenticator works also. But I felt that tool has too many options for what the Vivokey OTP applet does - all the USB stuff, and the other 2FA functionalities that aren’t needed. And it doesn’t work exactly like I wanted. And I have too much time on my hands I guess :slight_smile:

1 Like

Another excellent update. Thanks @anon3825968

1 Like

I added support for Steam Guard codes in Vivokey Codes. Now you can log into your Steam account using your Vivokey implant :slight_smile:

image

5 Likes

2 posts were merged into an existing topic: Apex Mega prototype update… getting closer!

Wtf are steam guard codes? How are they different from totp standard keys?

They are TOTP codes generated within the Steam App itself. As far as I can tell the only difference is the use of alphanumeric instead of just numbers.

What I want to know is how @anon3825968 managed to get the codes to be generated outside of the dedicated steam app. I’m looking for a tutorial of some kind somewhere but I’m not finding anything.

1 Like

Prob just the typical same binary data being represented by various different means.

1 Like

Nope. In this case, Steam codes are better: they have 5 alphanumerical characters picked from a 26-character set, meaning each code is 1 possibility out of 265 = 11,881,376. Ordinary TOTP codes of similar compacity have 6 digits, meaning each code is 1 possibility out of only 106 = 1,000,000.

Of course, normal TOTP can be up to 10 digits long (1 out of 10bn) and would be safer, but they’re nowhere as compact. Even 6-digit TOTP codes are longer than 5-character Steam codes.

I lifted it from the Yubikey Authenticator :slight_smile: It’s had that capability for years, and so have the Vivokey OTP applet and Vivokey Authenticator, since they’re straight forks of the Yubico stuff.

I was rummaging inside the code earlier today to find a way to get the OTP applet to calculate longer codes, to use it to generate encryption keys I could use with cryptsetup to encrypt partitions (it can by the way, that’s my next project) and I stumbled upon those “Steam code” things that are calculated differently than ordinary codes.

2 minutes of Googling revealed what they were (I don’t have a Steam account so I didn’t know they existed), 2 more minutes revealed that other TOTP authenticators already support them, and another minute to create a fake Steam account on my Apex showed me that the Vivokey Authenticator and vkman do indeed spew out Steam codes out of the box.

I figured it would be a desirable functionality for Apex-wearing gamers, so I added it.

In short, the code is the documentation. Read the code Luke :slight_smile: Look in mine for an easier “tutorial” than Yubico’s code: it’s still code, but it’s nowhere near as convoluted as Yubico’s. The gist of it is, the regular code is calculated by converting the 31-bit truncated code returned by the token to a 6- to 10-digit base-10 decimal number, while the Steam code is calculated by converting it to a 5-digit base 26 number with the digits encoded with a special alphanumerical character set. The relevant lines in vivokey_codes.py are from line 1204 to 1214.

7 Likes

I added support for Yubikey tokens - that is, the authenticator can read codes equally from Vivokey implants and NFC Yubikeys.

And in the Vivokey PAM module too.

5 Likes