Unlike the other ones posted here, this one just takes secrets as arguments:
> python -mtotp DGLTPWEUERUUDCEC SWPKQCKEWRXPCRXE
628502
674329
Further, if multiple users are logged into the same system (perhaps an unlikely scenario for most people), then secrets in command line arguments would expose the secrets in the output of ps -ef too thereby exposing the secrets to other users.
By the way, I have a similar script at https://github.com/susam/mintotp but it reads secrets from the standard input (as opposed to reading from command line arguments), one secret per line, and outputs TOTP values, one per line. Most of what this script does can be done with oathtool too and there is a section titled "Alternative: OATH Toolkit" in the README that documents this in detail.
Yes, and process arguments (such as from command line) can also be accessible in process list data that's accessible to other processes and users.
Even if the process only lives for an instant, or normally no other processes could access the data, good practice is to nevertheless keep secrets out of any process arguments.
Not exactly the same, but if you're using Bitwarden (which is compatible with generating TOTP tokens) to manage your passwords, you can use their bitwarden-cli tool to request tokens from the cli: https://bitwarden.com/help/cli/#get
But if you want the simplest cli thing, you can probably can use this golang ( https://github.com/yitsushi/totp-cli ) or this python ( https://github.com/WhyNotHugo/totp-cli ) implementations.
I know that this is not really answering your question, but most open-source TOTP apps (like andOTP and Aegis) can export all the TOTP in an encrypted file that you can save. So if you lose your main TOTP device you can restore all of them quite easily.
Alternatively, gopass[2], which re-implements pass in golang, has this functionality built in[3].
[0] https://github.com/tadfisher/pass-otp
[1] https://www.passwordstore.org/
[3] https://github.com/gopasspw/gopass/blob/master/docs/commands...
It allows export import feature of keys
This means your laptop itself would be your hardware device, the TOTP secret would be stored in the TPM and theoretically impossible to steal/copy. Of course this means you will probably want a mobile device (possibly a second laptop also) as a backup.)
This is secure because the secret never leaves the hardware key.
This is convenient because you launch a tool with a global keyboard shortcut and copy/paste the code. I use `yubikey-oath-dmenu` to allow me to quickly filter to the TOTP code I need.
You can also use python's pyotp.totp.now()
It relies on file permissions so is not exactly robustly secure (no idea about RAM vulnerabilities etc).
As per the author, I consider my laptop the fundamental point of vulnerability. If someone else gets access to it, I'll know and I'll hit the metaphorical panic button :)
Edit: I recently set up a new laptop, and copied my OTP seeds from Aegis into gauth without a hitch. Another step closer to me moving away from Authy.
By Unix-ish I mean something that is small and does one thing well. Like pipe in a secret to it and it gives me a TOTP? Pipe in multiple secrets and it gives me multiple TOTPs? Then I don't have to remain beholden to a custom encryption format. I can encrypt my secrets with other Unix-ish tools, decrypt it, pipe it to this tool and get my TOTPs. Recommendations?