Skip to content

Instantly share code, notes, and snippets.

@rofl0r

rofl0r/github_2fa_oathtool.md

Created October 11, 2023 21:54
Show Gist options
  • Star 2 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save rofl0r/877a765369184875f35966dc5ceced2f to your computer and use it in GitHub Desktop.
Save rofl0r/877a765369184875f35966dc5ceced2f to your computer and use it in GitHub Desktop.
Download ZIP
Using Github 2FA with oathtool
Raw
github_2fa_oathtool.md

I've been forced by github to enable 2FA with the following banner:

GitHub users are now required to enable two-factor authentication as an additional security measure. Your activity on GitHub includes you in this requirement. You will need to enable two-factor authentication on your account before October 12, 2023, or be restricted from account actions.

Fortunately, i managed to make the switch using the FLOSS oathtool, a non-bloated CLI program written in C.

Once you click the "Enable 2FA" button, github presents you a barcode and a link to uncover the embedded "setup key". All you really need is the setup key, which as it turns out is Base32-encoded. The next step is to enter a 6-digit code supplied by the TOTP app. Here it is extremely important that your system clock is correct, best to sync with NTP directly before use. The generated code is valid during 30 second "windows", so it is possible that if you're unlucky the window ends just in the next second.

The following oathtool command line provides you with the code: oathtool -b --totp=SHA1 SETUPKEY where SETUPKEY is the key presented to you earlier. Don't forget to save it in a secure place. Due to aforementioned time windows, it's possible you got to try 2-3 times copy/pasting the code spit out by oathtool, but in the end it will succeed. Once the code is accepted, github will provide you with some recovery codes which you can use to restore your account in case something goes wrong.

@m-g-r
Copy link

m-g-r commented Jan 8, 2024

Thank you, Hugo!

@user21944
Copy link

have you by any chance heard of and considered using KeePassXC

@rofl0r
Copy link
Author

rofl0r commented Jan 16, 2024 •
edited

the whole point of this was not having to use bloated gui apps with a built-in webbrowser (electron) that take up dozens of MB of disk space, and are a huge effort to compile from source due to the mix of trending programming language compilers they use. here we have a simple C program that compiles fine in 10 seconds with any C compiler shipped in the past 10 years, and takes up 3MB of space after installation, and i can manage where i save my keys myself, not having to put them inside some magic black box.

@R-obert
Copy link

R-obert commented Feb 7, 2024 •
edited

Thanks a lot!

--totp=SHA1 led to oathtool: invalid argument, "SHA1", for option --totp', but --totp=sha1 (case sensitive) works!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment