2FA on the command line

Re:2FA on the command line by mmcgaha on Thursday February 28, 2019 @04:37PM (#19275468)

This would be better if the key did not show up in the process list.

[ Parent | on HN ]

Re:2FA on the command line by mbushey on Thursday February 28, 2019 @05:03PM (#19275715)

I agree with you, however I'm the only user on my laptop so for the few milliseconds that oathtool is running it's not a problem for my use case.

$ time otp aws

otp aws 0.00s user 0.01s system 98% cpu 0.015 total

Even back in the 90's Mysql was able to hide the CLI supplied password from the process list. It would be cool if oathtool was able to do the same.

[ Parent | on HN ]

Re:2FA on the command line by null_content on Thursday February 28, 2019 @05:49PM (#19276134)

> Even back in the 90's Mysql was able to hide the CLI supplied password from the process list. It would be cool if oathtool was able to do the same.

This has always been a brittle and not easily portable approach.

And doesn't protect you from an attacker doing something much simpler: reading your .bash_history file.

Passing passwords as arguments has always been a bad idea.

[ Parent | on HN ]

Re:2FA on the command line by jwilk on Friday March 01, 2019 @11:52AM (#19282583)

This bug in oath-toolkit was reported a few years ago:

(Debian maintainer and upstream maintainer are the same person.)

[ Parent | on HN ]