gboudreau

Generating Authy passwords on other authenticators

---

*update: TBC, but this new might affect how easy it is to use this technique past August 2024: Authy is shutting down its desktop app | The 2FA app Authy will only be available on Android and iOS starting in August

---

This gist, based in part on a gist by Brian Hartvigsen, allows you to export from Authy your TOTP tokens you have stored there.
Those can be "standard" 6-digits / 30 secs tokens, or Authy's own version, the 7-digits / 10 secs tokens.

ethack

It "types" the contents of the clipboard.

Why can't you just paste the contents you ask? Sometimes pasting just doesn't work.

• One example is in system password fields on OSX.
• Sometimes you're working in a VM and the clipboard isn't shared.
• Other times you're working via Remote Desktop and again, the clipboard doesn't work in password boxes such as the system login prompts.
• Connected via RDP and clipboard sharing is disabled and so is mounting of local drives. If the system doesn't have internet access there's no easy way to get things like payloads or Powershell scripts onto it... until now.

Windows

The Windows version is written in AutoHotKey and easily compiles to an executable. It's a single line script that maps Ctrl-Shift-V to type the clipboard.

nuomi1

#!/usr/bin/env swift

//
//  PrintBootCampESDInfo.swift
//
//  Created by nuomi1 on 8/5/18.
//  Copyright © 2018年 nuomi1. All rights reserved.
//

import Foundation

johannrichard

# Defaults / Configuration options for homebridge
# The following settings tells homebridge where to find the config.json file and where to persist the data (i.e. pairing and others)
HOMEBRIDGE_OPTS=-U /var/lib/homebridge

# If you uncomment the following line, homebridge will log more 
# You can display this via systemd's journalctl: journalctl -f -u homebridge
# DEBUG=*

snej

#if TARGET_OS_IPHONE
#import <UIKit/UIKit.h>
typedef UIImage QRImage;
#else
#import <AppKit/AppKit.h>
typedef NSImage QRImage;
#endif


+ (QRImage*) QRCodeImageWithData: (NSData*)data size: (CGFloat)size {

mseeley

<?xml version="1.0" encoding="UTF-8"?>
<Client name="PlayStation 4">
  <!-- Author: Plex Inc. -->
  <!-- http://blog.us.playstation.com/2015/06/15/media-player-coming-to-ps4/ -->
  <Identification>
    <Header name="User-Agent" substring="PlayStation 4" />
    <Header name="User-Agent" substring="UPnP/1.0 DLNADOC/1.50" />
  </Identification>

  <TranscodeTargets>

tresni

Moving Authy to 1Password

1Password 5.3 for OSX, 5.2 for iOS, and 4.1.0.538 for Windows support OTP. I've been using Authy for a while now, but the fact is, I haven't really been using 2FA for some time. As mentioned by 1Password in a recent blog post, having the OTP generator and password on the same device is very much not 2FA. It's just an expiring OTP, which can help, but let's not kid ourselves too much.

With that out of the way. One of the things that was interesting to me was moving my OTP out of Authy and into 1Password. I like the control I get with 1Password, but I didn't want to have to reset all my OTP right away, that would suck. So, I got to dissecting the Authy Chrome App to see what I could do.

Run the Authy Chrome app and make sure it's unlocked.

Now, enable Developer mode in Chrome. We'll need this to inspect the background application that stores al

vilhalmer

NSVisualEffectMaterial constants, and the undocumented materials they coorespond to in various modes:
+----------------------+-------+----------+------+---------+
|      MATERIAL #      | LIGHT | LIGHT EM | DARK | DARK EM |
+----------------------+-------+----------+------+---------+
|                      |       |          |      |         |
| 0 - Appearance Based | 3     | 3        | 5    | 5       |
|                      |       |          |      |         |
| 1 - Light            | 3     | 3        | 3    | 3       |
|                      |       |          |      |         |
| 2 - Dark             | 4     | 4        | 4    | 4       |

xem

<!-- solution 1, 117b, inspired by http://www.p01.org/releases/140bytes_music_softSynth/ -->
<button onclick="new Audio('data:audio/wav;base64,UklGRl9vT19XQVZFZm10IBAAAAABAAEAQB8AAEAfAAABAAgAZGF0YU'+Array(1e3).join(123)).play()">Beep</button>

<!-- Solution 2, 107b, inspired by http://xem.github.io/chip8/c8.html -->
<button onclick="o=(A=new AudioContext()).createOscillator();o.connect(A.destination);o.start(0);setTimeout('o.stop(0)',500)">Boop</button>

stbuehler

#!/usr/bin/ruby

# REQUIRES:
# * rooted android, as otherwise you can't read the applications private data
# * to display the qr code "qrencode" (http://fukuchi.org/works/qrencode/)
#   and "display" from ImageMagick

# This script "decrypts" the token from the internal state of the
# Battle.net Mobile Authenticator on android application, converting
# it into an "otpauth" url (https://code.google.com/p/google-authenticator/wiki/KeyUriFormat)