Re:DontDuo: Bypass 2FA with DTMF Tones
by goode on Wednesday September 11, 2019 @02:15AM
(#20937065)
Duo was one of the last things keeping me from switching to Google-free AOSP, and I toyed with a similar idea while trying to reverse-engineer a free software replacement. Instead, I ended up writing a small tool that allows you to use any old HOTP authenticator with Duo. I use FreeOTP+ on my phone, but you could just as easily stick that HOTP secret in a script or onto a Yubikey. You might find it useful if you're working your way up to 100% Stallman status: https://github.com/evan-goode/duolibre.
By the way, I gotta say this project is pretty hilarious, and you're a true baller for trying to sell this to people.
By the way, I gotta say this project is pretty hilarious, and you're a true baller for trying to sell this to people.