Oathtool
06 OATH Options and Oathtool
The OATH standard has several options.
You need to know which OATH options the site you wish to log into uses in order to use OATH.
07 Options - TOTP versus HOTP
There are two different types of OATH one time passwords, HOTP and TOTP.
HOTP uses a counter.
I won't go into more detail on HOTP as I haven't come across anyone using it.
TOTP uses the current time instead of a counter.
The time is fed into the OATH algorithm along with the shared secret to generate a new password on both ends of the connection.
All the instances of OATH that I am familiar with use TOTP.
08 TOTP Mode
Totp has different "modes".
These modes are hash encoding algorithms such as SHA1, SHA256, or SHA512.
The correct mode must be selected in order to log in using OATH with TOTP.
09 Encoding - Hex versus Base32
Both ends of the connection must be initialized with a shared secret or key which is required as part of the OATH algorithm.
This key could be encoded in one of two forms, either hexadecimal or base32.
Web sites often do not document which encoding method they are using.
If you cannot determine the encoding of the key by simply looking at it you may need to use trial and error during your first OATH log in attempts to see which type of key has been used.
10 Github and Pypi Options
Github and Pypi are two of the most prominent web sites using OATH.
Both use the same options, TOTP with SHA1 mode, and base32 encoding.
11 Using Oathtool
oathtool is a simple command line application which generates one time passwords for use with OATH.
It can be run in a terminal.
However, can also be turned into a simple GUI application using Zenity. Will discuss this in more detail later.
By default oathtool uses hotp and hex encoding.
To use totp and base32 encoding you must specify these on the command line.
To specify base32 encoding for use with for example Github, pass the "-b" or "--base32" argument on the command line.
To specify TOTP, pass the "--totp" argument on the command line.
By default, oathtool uses SHA1 with totp, so you don't need to specify that if you require SHA1.
If you need a different TOTP mode, you specify that as part of the TOTP argument separated by an "=" character. For example "--totp=SHA256".
12 Oathtool Example
Here is a simple example of using oathtool to create a one time password to use with Github or Pypi.
Open a terminal and type the following.
oathtool -b --totp SOMEBIGBASE32SECRETCODE
The one time password will be printed out in the terminal.
You can try this out without using a valid key so long as it is a valid base32 string.
When used with a valid key you then enter that one time password into Github, Pypi, or other web site where it asks for the one time password.
Note that I have not covered in the above how to store and retrieve the key securely, as that is too big of a topic to cover here.
13 Zenity Example
Oathtool is a command line application, but if you are using Linux it is simple to convert it into a GUI application by using "Zenity".
Zenity is a simple to use package that creates GUI windows on the command line or in a shell script.
There are two steps to the proceess.
First create the OTP from the key by using oathtool and save it in a variable.
Next, call a Zenity "info" window wit
All content for Hacker Public Radio is the property of Hacker Public Radio and is served directly from their servers
with no modification, redirects, or rehosting. The podcast is not affiliated with or endorsed by Podjoint in any way.
Oathtool
06 OATH Options and Oathtool
The OATH standard has several options.
You need to know which OATH options the site you wish to log into uses in order to use OATH.
07 Options - TOTP versus HOTP
There are two different types of OATH one time passwords, HOTP and TOTP.
HOTP uses a counter.
I won't go into more detail on HOTP as I haven't come across anyone using it.
TOTP uses the current time instead of a counter.
The time is fed into the OATH algorithm along with the shared secret to generate a new password on both ends of the connection.
All the instances of OATH that I am familiar with use TOTP.
08 TOTP Mode
Totp has different "modes".
These modes are hash encoding algorithms such as SHA1, SHA256, or SHA512.
The correct mode must be selected in order to log in using OATH with TOTP.
09 Encoding - Hex versus Base32
Both ends of the connection must be initialized with a shared secret or key which is required as part of the OATH algorithm.
This key could be encoded in one of two forms, either hexadecimal or base32.
Web sites often do not document which encoding method they are using.
If you cannot determine the encoding of the key by simply looking at it you may need to use trial and error during your first OATH log in attempts to see which type of key has been used.
10 Github and Pypi Options
Github and Pypi are two of the most prominent web sites using OATH.
Both use the same options, TOTP with SHA1 mode, and base32 encoding.
11 Using Oathtool
oathtool is a simple command line application which generates one time passwords for use with OATH.
It can be run in a terminal.
However, can also be turned into a simple GUI application using Zenity. Will discuss this in more detail later.
By default oathtool uses hotp and hex encoding.
To use totp and base32 encoding you must specify these on the command line.
To specify base32 encoding for use with for example Github, pass the "-b" or "--base32" argument on the command line.
To specify TOTP, pass the "--totp" argument on the command line.
By default, oathtool uses SHA1 with totp, so you don't need to specify that if you require SHA1.
If you need a different TOTP mode, you specify that as part of the TOTP argument separated by an "=" character. For example "--totp=SHA256".
12 Oathtool Example
Here is a simple example of using oathtool to create a one time password to use with Github or Pypi.
Open a terminal and type the following.
oathtool -b --totp SOMEBIGBASE32SECRETCODE
The one time password will be printed out in the terminal.
You can try this out without using a valid key so long as it is a valid base32 string.
When used with a valid key you then enter that one time password into Github, Pypi, or other web site where it asks for the one time password.
Note that I have not covered in the above how to store and retrieve the key securely, as that is too big of a topic to cover here.
13 Zenity Example
Oathtool is a command line application, but if you are using Linux it is simple to convert it into a GUI application by using "Zenity".
Zenity is a simple to use package that creates GUI windows on the command line or in a shell script.
There are two steps to the proceess.
First create the OTP from the key by using oathtool and save it in a variable.
Next, call a Zenity "info" window wit
HPR4502: Cheap Yellow Display Project Part 3: Reverse beacon network
Hacker Public Radio
2 days ago
HPR4502: Cheap Yellow Display Project Part 3: Reverse beacon network
Hello, again. This is Trey.
Welcome to part 3 in my Cheap Yellow Display (CYD) Project series. You can find Part 1 in episode 4472 and Part 2 in episode 4488.
We previously left our handy hero searching for a solution to an amateur radio signal propagation dilemma, while he is trying to become proficient with Morse code. The CYD technology is simmering in the back of his brain – an answer in search of a problem.
Hah! I love trying to create the feel of a vintage radio or television series with the intro and outro for these episodes. But I am by no means the hero. I am simply Trey – a grumpy old man and tinkerer. Instead, the real hero in this episode is Keith
VE3SVQ-THE SHAKY KEY
on YouTube.
So.... Let's see. Where were we? Oh yes. I have been trying to learn Morse code
-.-. --.- -.-. --.- (CQ CQ)
That was me, tapping out "CQ CQ" in Morse code using the practice set I keep on my desk. This consists of a set of code paddles, connected to an Arduino Nano, which I built several years ago based what I learned watching
Code Practice Oscillator; Aka: The Three Arduinos
on Jmhrvy1947's YouTube Channel, and based on the code from
his GitHub
https://github.com/jmharvey1/ArduinoCPO
. I did need to make modifications, both to support the Ardunio Nano on which I chose to run it, and for my own sanity, as the way that I learned to write code for Ardunio is very different. I focus on readability and flexibility. You can see these changes on
my own GitHub
(
https://github.com/jttrey3/PracticeOscillator/blob/main/PracticeOscillator.ino
)
Anyway, I have been studying. I have been watching videos. I have been practicing. I might actually be learning some of this stuff. If you are interested in more details about the resources I am using, leave a comment for this episode, or drop me an email using the address in my profile, and I may record an episode about it.
The result is that I have been learning. But also, the google and YouTube algorithms have bee
Hacker Public Radio
Oathtool
06 OATH Options and Oathtool
The OATH standard has several options.
You need to know which OATH options the site you wish to log into uses in order to use OATH.
07 Options - TOTP versus HOTP
There are two different types of OATH one time passwords, HOTP and TOTP.
HOTP uses a counter.
I won't go into more detail on HOTP as I haven't come across anyone using it.
TOTP uses the current time instead of a counter.
The time is fed into the OATH algorithm along with the shared secret to generate a new password on both ends of the connection.
All the instances of OATH that I am familiar with use TOTP.
08 TOTP Mode
Totp has different "modes".
These modes are hash encoding algorithms such as SHA1, SHA256, or SHA512.
The correct mode must be selected in order to log in using OATH with TOTP.
09 Encoding - Hex versus Base32
Both ends of the connection must be initialized with a shared secret or key which is required as part of the OATH algorithm.
This key could be encoded in one of two forms, either hexadecimal or base32.
Web sites often do not document which encoding method they are using.
If you cannot determine the encoding of the key by simply looking at it you may need to use trial and error during your first OATH log in attempts to see which type of key has been used.
10 Github and Pypi Options
Github and Pypi are two of the most prominent web sites using OATH.
Both use the same options, TOTP with SHA1 mode, and base32 encoding.
11 Using Oathtool
oathtool is a simple command line application which generates one time passwords for use with OATH.
It can be run in a terminal.
However, can also be turned into a simple GUI application using Zenity. Will discuss this in more detail later.
By default oathtool uses hotp and hex encoding.
To use totp and base32 encoding you must specify these on the command line.
To specify base32 encoding for use with for example Github, pass the "-b" or "--base32" argument on the command line.
To specify TOTP, pass the "--totp" argument on the command line.
By default, oathtool uses SHA1 with totp, so you don't need to specify that if you require SHA1.
If you need a different TOTP mode, you specify that as part of the TOTP argument separated by an "=" character. For example "--totp=SHA256".
12 Oathtool Example
Here is a simple example of using oathtool to create a one time password to use with Github or Pypi.
Open a terminal and type the following.
oathtool -b --totp SOMEBIGBASE32SECRETCODE
The one time password will be printed out in the terminal.
You can try this out without using a valid key so long as it is a valid base32 string.
When used with a valid key you then enter that one time password into Github, Pypi, or other web site where it asks for the one time password.
Note that I have not covered in the above how to store and retrieve the key securely, as that is too big of a topic to cover here.
13 Zenity Example
Oathtool is a command line application, but if you are using Linux it is simple to convert it into a GUI application by using "Zenity".
Zenity is a simple to use package that creates GUI windows on the command line or in a shell script.
There are two steps to the proceess.
First create the OTP from the key by using oathtool and save it in a variable.
Next, call a Zenity "info" window wit
