replydev/cotp

Trustworthy, encrypted, command-line TOTP/HOTP authenticator app with import functionality.

cotp's Issues

Feature Request: Aegis encrypted export

Hey thank you for this neat little tool.
When i first tried to import my aegis json file it spit out a huge error. Then i realized it's because of the encryption used when exporting aegis.

Yes, I'm aware that i can export from aegis without encryption! But it would be convenient if it would take encrypted json files :)

EDIT:
Probably this function for decryption

[Feature Request] In-UI HOTP counter incrementation

Howdy!

I just found this tool, and I think it's super handy! I'm using it with an HOTP secret I need for a login I use regularly. One problem I've encountered is that in order to increment the counter, I need to first run cotp info -i <n> to get the current counter value, followed by cotp edit -i 1 --counter <x+1> to increment it, then finally enter the UI with cotp to get the code - a process which involves entering my password three times, and a lot of commands, even if you have the index memorized.

I'd like to request a way to increment / decrement the counter from within the UI, perhaps incrementing it when the user presses Enter (+ copying the old code), and decrementing it with Shift+Enter, or whatever way you think best. This would dramatically improve the workflow for using HOTP codes, and I think improve the software over all.

Thanks for the great software!

[Feature request] Is it possible to support some kind(s) portable mode?

Is it possible to support a portable mode? I think it will be much concise and easy to use if it does!

I have concluded 3 possible options:

1. By specify the location of the the core db file ".cotp\db.cotp", to a user specified place. The command switch would be:
   cotp db --path 'path/to/the/db.cotp'.

2. Add a portable switch, and load the db in the same folder:
   cotp --portable

3. Check if a blank file named 'portable_mode' exists, if yes, load the db in the same folder.

Thanks in advance!

Use once_cell crate for lazy initialization

segfault in cipher

hi, i got this segfault, see details:

• cotp commit 49d2c1f
• cargo 1.58.0 (f01b232bc 2022-01-19)
• cargo build target: release
• ~/.cotp/db.cotp does not exist
• failing command: cotp add -i xyz -l xyz@xyz -a SHA1 -d 6

(gdb) bt
#0  0x8000a4ca in chacha20poly1305::cipher::Cipher$LT$C$GT$::new::hed69a7d757b7398b ()
#1  0x800327f7 in cotp::database_management::overwrite_database_json::h53b38a1489223167 ()
#2  0x8003b4e8 in cotp::main::h633cef697bb2ae07 ()
#3  0x8000b6ae in std::sys_common::backtrace::__rust_begin_short_backtrace::hcb8c7447e08876a5 ()
#4  0x8003e256 in main ()

Chromium 117 freezes for several seconds when attempting to paste the token

I am experiencing chromium (v 117) freeze on my linux laptop. Switching the clipboard provider from copypasta_ext::x11_fork::ClipboardContext to copypasta_ext::x11_bin::ClipboardContext solves the issue for me.

The documentation of fork provider seems to mention it:

The fork might cause weird behaviour for some applications.

How can I use Cotp with Microsoft Teams?

Microsoft Teams gives me a (non-URI) account name "Example Inc:[email protected]" and a secret key "8khfaew89hef9". (Not real values, just examples of the format.)

How do I add these to Cotp?

$ cotp add
error: the following required arguments were not provided:
  --otpuri
  --label <LABEL>

Usage: cotp add --otpuri --label <LABEL>

OSC52 support (copying in remote terminals)

Thanks for the great app, it's exactly what I'm looking for ✨

I'm using it on a remote server, would you be interested in OSC52 support? It may be possible to implement with Cargo's copypasta-ext. I'm happy to try a PR if it would help.

Also, would you be interested in a setting to reduce the line spacing?

[Feature request] Is it possible to add URI string format support for both import and export

Hello community,

The otpauth:// URI scheme was originally formalized by Google. It's very common to see sites all around world use this format for the 2FA setup process. Is it possible to add a feature to import an utf-8 encoded file which contains a list of otpauth:// URI?

The file content is like this:

otpauth://totp/Example:[email protected]?secret=JBSWY3DPEHPK3PXP&issuer=Example
otpauth://totp/Example:[email protected]?secret=JBSWY3DPEHPK3PXP&issuer=Example

the command switch could be something like:
cotp import --otpauth_uri --path "./utf8encoded.txt"

Thanks in advance!

convert export.cotp

How to convert he export from cotp ?
i mean "cotp export"

i need the files back converted for other tools like freeotp+

Configure Cache in CI/CD

Check feasibility and use https://github.com/Swatinem/rust-cache#rust-cache-action to improve CI/CD times.

Minor typo s/chages/changes

cotp/src/interface/handler.rs

Line 332 in 7e1ddcc

text: String::from("Do you want to save your chages? [Y/N]"),

Bug: core dumped after entering cotp password - cotp v1.2.2

After entering the cotp password, the following error message appears:
thread 'main' panicked at 'called Result::unwrap() on an Err value: "DecodeError { position: 26, kind: Symbol }"', src/interface/table.rs:73:36
note: run with RUST_BACKTRACE=1 environment variable to display a backtrace
Aborted (core dumped)

Tested with cotp-bin v1.2.2-1 on Arch linux: https://aur.archlinux.org/cotp-bin.git

Reference:

cotp/src/interface/table.rs

Line 73 in d789c61

element.get_otp_code().unwrap(),

Custom path for DB file

Hello,

Thanks for this utility!

It would be nice to have possibility to set custom path for DB file.
For example, override default path to DB file with COTP_DB_PATH environment variable, if it's provided.

Thanks.

Export to widely know format

It's super nice that I can import my keys from a various of formats, but sometimes I also want to sync my keys to others apps that I use. For example, there is Aegis on my mobile device and after I tried all the options that it suggests (more than 10 formats) and none of them fit.

It would be nice to have an option to export data to widely know format.

I would appreciate any recommendation in utils to convert cotp export to any of formats which is know by Aegis.

List of formats available for Aegis:
2FAS Authenticator
Aegis
andOTP
Authenticator Plus
Authy
Battle.net Authenticator
Bitwarden
Duo
FreeOTP
FreeOTP+
Google Authenticator
Microsoft Authenticator
Plain Text (have no idea on the format, though)
Steam
TOTP Authenticator
WinAuth

thread 'main' panicked at 'called `Result::unwrap()`

I added a new OTP code, but now cotp crashes when trying to unlock. Did I insert some invalid characters by accident?

cotp v0.1.7
written by @replydev

Password:
thread 'main' panicked at 'called Result::unwrap() on an Err value: InvalidSecret(DecodeError { position: 6, kind: Symbol })', src/otp/otp_helper.rs:67:90
stack backtrace:
0: 0x5557804e2730 - std::backtrace_rs::backtrace::libunwind::trace::h38f496e2f60ff056
at /build/rust/src/rustc-1.51.0-src/library/std/src/../../backtrace/src/backtrace/libunwind.rs:90:5
1: 0x5557804e2730 - std::backtrace_rs::backtrace::trace_unsynchronized::h56106da60d2adf4e
at /build/rust/src/rustc-1.51.0-src/library/std/src/../../backtrace/src/backtrace/mod.rs:66:5
2: 0x5557804e2730 - std::sys_common::backtrace::_print_fmt::he96612ccef88d499
at /build/rust/src/rustc-1.51.0-src/library/std/src/sys_common/backtrace.rs:67:5
3: 0x5557804e2730 - <std::sys_common::backtrace::_print::DisplayBacktrace as core::fmt::Display>::fmt::h7bc9abcb54e035e8
at /build/rust/src/rustc-1.51.0-src/library/std/src/sys_common/backtrace.rs:46:22
4: 0x5557804ff4ac - core::fmt::write::hc902605fce7cd9d0
at /build/rust/src/rustc-1.51.0-src/library/core/src/fmt/mod.rs:1096:17
5: 0x5557804df845 - std::io::Write::write_fmt::hc1b61b7b2ff05b80
at /build/rust/src/rustc-1.51.0-src/library/std/src/io/mod.rs:1568:15
6: 0x5557804e4855 - std::sys_common::backtrace::_print::hbfdf09e2f4163e71
at /build/rust/src/rustc-1.51.0-src/library/std/src/sys_common/backtrace.rs:49:5
7: 0x5557804e4855 - std::sys_common::backtrace::print::h0f74697e38abc595
at /build/rust/src/rustc-1.51.0-src/library/std/src/sys_common/backtrace.rs:36:9
8: 0x5557804e4855 - std::panicking::default_hook::{{closure}}::hddc95caf81a22541
at /build/rust/src/rustc-1.51.0-src/library/std/src/panicking.rs:208:50
9: 0x5557804e43b3 - std::panicking::default_hook::h3eba1f2638a2c835
at /build/rust/src/rustc-1.51.0-src/library/std/src/panicking.rs:225:9
10: 0x5557804e4ff1 - std::panicking::rust_panic_with_hook::h8f88f1391abedf2a
at /build/rust/src/rustc-1.51.0-src/library/std/src/panicking.rs:591:17
11: 0x5557804e4b37 - std::panicking::begin_panic_handler::{{closure}}::hf473b53e26f56dd7
at /build/rust/src/rustc-1.51.0-src/library/std/src/panicking.rs:497:13
12: 0x5557804e2bcc - std::sys_common::backtrace::__rust_end_short_backtrace::h6fde4603ccb02286
at /build/rust/src/rustc-1.51.0-src/library/std/src/sys_common/backtrace.rs:141:18
13: 0x5557804e4a99 - rust_begin_unwind
at /build/rust/src/rustc-1.51.0-src/library/std/src/panicking.rs:493:5
14: 0x5557804fde41 - core::panicking::panic_fmt::hac8c69602870cdf7
at /build/rust/src/rustc-1.51.0-src/library/core/src/panicking.rs:92:14
15: 0x5557804fdc63 - core::option::expect_none_failed::h7dfb96068fc9393b
at /build/rust/src/rustc-1.51.0-src/library/core/src/option.rs:1300:5
16: 0x5557804760f0 - cotp::otp::otp_helper::get_good_otp_code::hc0c2526e9ba65e40
17: 0x5557804757a6 - cotp::otp::otp_helper::show_codes::h48fb5873267a30a8
18: 0x555780477d0f - cotp::main::h3f3a62180fef9322
19: 0x5557804786f3 - std::sys_common::backtrace::__rust_begin_short_backtrace::ha6798c2b8a70492a
20: 0x55578046aa89 - std::rt::lang_start::{{closure}}::h06055368eb7f2e5f
21: 0x5557804e5417 - core::ops::function::impls::<impl core::ops::function::FnOnce for &F>::call_once::h6646ba386ff34dbe
at /build/rust/src/rustc-1.51.0-src/library/core/src/ops/function.rs:259:13
22: 0x5557804e5417 - std::panicking::try::do_call::h47e376e14a330979
at /build/rust/src/rustc-1.51.0-src/library/std/src/panicking.rs:379:40
23: 0x5557804e5417 - std::panicking::try::hb7ef6d6b3d4db346
at /build/rust/src/rustc-1.51.0-src/library/std/src/panicking.rs:343:19
24: 0x5557804e5417 - std::panic::catch_unwind::h534d7ac891813066
at /build/rust/src/rustc-1.51.0-src/library/std/src/panic.rs:431:14
25: 0x5557804e5417 - std::rt::lang_start_internal::h8191eeb0dbee8736
at /build/rust/src/rustc-1.51.0-src/library/std/src/rt.rs:51:25
26: 0x555780477e82 - main
27: 0x7fbb4bec1b25 - __libc_start_main
28: 0x55578045c17e - _start
29: 0x0 -

Use color-eyre crate for error handling

color-eyre [docs]
A fork of anyhow that gives you more control over the format of the generated error messages. Recommended if you intend to present error messages to end users. Otherwise anyhow is simpler.

Error editing entry

Thank you very much for this app, I find it very convenient and use it a lot.

Now to the problem, when I try to edit existing entry I receive following error:

[0] $ cotp edit -i 8 -l withdraw
Password: 
thread 'main' panicked at 'Mismatch between definition and access of `index`. Could not downcast to TypeId { t: 13834754221672687376 }, need to downcast to TypeId { t: 8562976148318468642 }
', $HOME/.cargo/registry/src/github.com-1ecc6299db9ec823/clap-4.1.1/src/parser/error.rs:30:9
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
Aborted

Here is the same thing with RUST_BACKTRACE=full

[0] $ RUST_BACKTRACE=full cotp edit -i 8 -l withdraw
Password: 
thread 'main' panicked at 'Mismatch between definition and access of `index`. Could not downcast to TypeId { t: 13834754221672687376 }, need to downcast to TypeId { t: 8562976148318468642 }
', /home/grbit/.cargo/registry/src/github.com-1ecc6299db9ec823/clap-4.1.1/src/parser/error.rs:30:9
stack backtrace:
   0:     0x5594bcd2e469 - <unknown>
   1:     0x5594bcccebbe - <unknown>
   2:     0x5594bcd06644 - <unknown>
   3:     0x5594bcd2f4ff - <unknown>
   4:     0x5594bcd2f0ff - <unknown>
   5:     0x5594bcd30168 - <unknown>
   6:     0x5594bcd2fc52 - <unknown>
   7:     0x5594bcd2fbbc - <unknown>
   8:     0x5594bcd2fb91 - <unknown>
   9:     0x5594bcc5c3f2 - <unknown>
  10:     0x5594bcc94bd4 - <unknown>
  11:     0x5594bcc65f55 - <unknown>
  12:     0x5594bcc9a8c7 - <unknown>
  13:     0x7fb8ad269d0a - __libc_start_main
  14:     0x5594bcc61bfa - <unknown>
  15:                0x0 - <unknown>
Aborted

Maybe I'm doing something in a wrong way, then please explain me how to edit entries in my cotp database.

Should downstream packaging include importers?

As I picked up cotp in Arch Linux packaging I got to thinking about the usage instructions, and I think it might be good to ship some of the importers somewhere (e.g. /usr/share/cotp/improters or something), add the necessary python stuff as opt-depends, and have some sort of indication in the docs how to run this. Or perhaps this should be a split package cotp-importers with all the dependencies included and a wrapper script that makes it easy to locate all the import scripts.

Thoughts?

Consider using the xdg specification

From the XDGBDS :

There is a single base directory relative to which user-specific data files should be written. This directory is defined by the environment variable $XDG_DATA_HOME.

It would be nice if the path to the database was not hardcoded but relied on XDG_DATA_HOME, e.g. XDG_DATA_HOME/cotp/db.cotp. In any case I would like to suggest printing out the database path before quitting.

Document the need for libxcb development libs and headers in the README

Hello! Opening this issue to raise awareness for this necessity since I went to install the package through cargo and it gave me the error:

  = note: /usr/bin/ld: cannot find -lxcb-render
          /usr/bin/ld: cannot find -lxcb-shape
          /usr/bin/ld: cannot find -lxcb-xfixes

To resolve that I installed the libxcb-devel (in Fedora 35) package, which wasn't specified in the README, I think it's important to have it there highlighted as a dependency.

Migrate to ratatui as tui-rs is unmainteined

Can you make the json import work with another Authy exporter?

https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d958c93 This is a root-less way to acquire Authy tokens, and doesn't require any conversion, can this method be parsed as well? Currently when attempting to import, I receive this error:

Error during compiling on Alpinelinux

Thank you for creating this program. I found this when l was looking an OTP manager (compatible with Authy) on Alpine.

I have tried to compile binary from the source code on Alpine 3.13.5 but it says the following errors. Please help me. Thank you.

Compiling cotp v0.1.8 (/root/cotp)
error[E0271]: type mismatch resolving `<[u8; 16] as std::convert::TryFrom<std::vec::Vec<u8>>>::Error == std::vec::Vec<u8>`
  --> src/cryptograpy.rs:86:14
   |
86 |     byte_vec.try_into()
   |              ^^^^^^^^ expected enum `std::convert::Infallible`, found struct `std::vec::Vec`
   |
   = note: expected enum `std::convert::Infallible`
            found struct `std::vec::Vec<u8>`

error[E0277]: the trait bound `[u8; 16]: std::convert::From<std::vec::Vec<u8>>` is not satisfied
  --> src/cryptograpy.rs:86:14
   |
86 |     byte_vec.try_into()
   |              ^^^^^^^^ the trait `std::convert::From<std::vec::Vec<u8>>` is not implemented for `[u8; 16]`
   |
   = help: the following implementations were found:
             <[u8; 4] as std::convert::From<ring::endian::BigEndian<u32>>>
             <[u8; 4] as std::convert::From<ring::endian::LittleEndian<u32>>>
             <[u8; 8] as std::convert::From<ring::endian::BigEndian<u64>>>
             <[u8; 8] as std::convert::From<ring::endian::LittleEndian<u64>>>
   = note: required because of the requirements on the impl of `std::convert::Into<[u8; 16]>` for `std::vec::Vec<u8>`
   = note: required because of the requirements on the impl of `std::convert::TryFrom<std::vec::Vec<u8>>` for `[u8; 16]`
   = note: required because of the requirements on the impl of `std::convert::TryInto<[u8; 16]>` for `std::vec::Vec<u8>`

error[E0271]: type mismatch resolving `<[u8; 24] as std::convert::TryFrom<std::vec::Vec<u8>>>::Error == std::vec::Vec<u8>`
  --> src/cryptograpy.rs:91:14
   |
91 |     byte_vec.try_into()
   |              ^^^^^^^^ expected enum `std::convert::Infallible`, found struct `std::vec::Vec`
   |
   = note: expected enum `std::convert::Infallible`
            found struct `std::vec::Vec<u8>`

error[E0277]: the trait bound `[u8; 24]: std::convert::From<std::vec::Vec<u8>>` is not satisfied
  --> src/cryptograpy.rs:91:14
   |
91 |     byte_vec.try_into()
   |              ^^^^^^^^ the trait `std::convert::From<std::vec::Vec<u8>>` is not implemented for `[u8; 24]`
   |
   = help: the following implementations were found:
             <[u8; 4] as std::convert::From<ring::endian::BigEndian<u32>>>
             <[u8; 4] as std::convert::From<ring::endian::LittleEndian<u32>>>
             <[u8; 8] as std::convert::From<ring::endian::BigEndian<u64>>>
             <[u8; 8] as std::convert::From<ring::endian::LittleEndian<u64>>>
   = note: required because of the requirements on the impl of `std::convert::Into<[u8; 24]>` for `std::vec::Vec<u8>`
   = note: required because of the requirements on the impl of `std::convert::TryFrom<std::vec::Vec<u8>>` for `[u8; 24]`
   = note: required because of the requirements on the impl of `std::convert::TryInto<[u8; 24]>` for `std::vec::Vec<u8>`

error: aborting due to 4 previous errors

Some errors have detailed explanations: E0271, E0277.
For more information about an error, try `rustc --explain E0271`.
error: failed to compile `cotp v0.1.8 (/root/cotp)`, intermediate artifacts can be found at `/root/cotp/target`

Caused by:
  could not compile `cotp`.

To learn more, run the command again with --verbose.

Error after importing from Aegis backup with Steam entries

As mentioned here, Aegis supports Steam entries. If a backup contains a Steam entry and it's imported into cotp, this error shows every time cotp is ran. I assume this same error would occur for Yandex entries, but I have not tested this.

Possible Solutions:

• skip steam and yandex entries and display a warning that these cannot be imported
• add support for steam and yandex

The automated release is failing 🚨

🚨 The automated release from the main branch failed. 🚨

I recommend you give this issue a high priority, so other packages depending on you can benefit from your bug fixes and new features again.

You can find below the list of errors reported by semantic-release. Each one of them has to be resolved in order to automatically publish your package. I’m sure you can fix this 💪.

Errors are usually caused by a misconfiguration or an authentication problem. With each error reported below you will find explanation and guidance to help you to resolve it.

Once all the errors are resolved, semantic-release will release your package the next time you push a commit to the main branch. You can also manually restart the failed CI job that runs semantic-release.

If you are not sure how to resolve this, here are some links that can help you:

• Usage documentation
• Frequently Asked Questions
• Support channels

If those don’t help, or if this issue is reporting something you think isn’t right, you can always ask the humans behind semantic-release.

---

Unfortunately this error doesn't have any additional information. Feel free to kindly ask the author of the @semantic-release/exec plugin to add more helpful information.

---

Good luck with your project ✨

Your semantic-release bot 📦🚀

No issue: just some info

Hi, first off, thank you! I love this!
Although Aegis is amazing, half the time, I need the code for the terminal and cotp does that perfectly, exporting from Aegis was made easy by cotp too.
In fact, it works so good that I went a step further completely deleted Aegis and built cotp on Termux (so I can still always access my codes away from my PC), now I am writing a small bash script for a Termux shortcut (a widget on my homescreen), when clicking it, if it detects a URL saved on my clipboard, it will try to find the coresponding entry (e.g https://github.com will return my github code, etc.), else prompts you to select one of your entries.
Good bye interpreted, memory-hogging Java and hello Rust! :)
So this is...
A: Thank you!
B: Reporting it works perfectly on Android for your ReadMe,
C: Whilst I was there, I noticed "Nix OS" wasnt listed, I can confirm it works on this distro too, another one for the ReadMe!

I'll close this now 🤣

Feature Request: A way to share HOTP/TOTP URI outside of QR encoding

Sometimes you may want to just share the URI, and not export all TOTP/HOTP URIs, it'd be nice when you press k to view the QR code, to also get a non-QR encoded version of URI. This could be it's own bind as well, something like Enter that copies the code to clipboard can work as well (maybe Shift+Enter). Saves the hassle of having to screenshot the QR code and use something like qrrs on it.

Google Authenticator import

How do I import from Google Authenticator on Android without root?

[Feature request] Is it possible to add a Page Up/Down page navigation feature for the UI

Hi, @replydev!

Many users may have no more than two pages of codes, if it could use the Page Up/Page Down key to navigate to the previous/next page, it could be much easier than using current arrow keys or the Ctrl+F combination.

Thanks in advance!

Modified: Added some small modifications to the Features section and new help text to match the current App , hope they could be helpful!

Happy winter holidays!

Features

Portable Mode

Cotp supports both Portable mode and XDG_DATA_HOME:

If COTP_DB_PATH is set, use that as the full path.
If $(pwd)/db.cotp exists, use that path for portability mode.
If ~/.cotp exists, use that prefix for backwards compatibility but warn the default location has changed.
Check if XDG_DATA_HOME is set, if so use it as prefix with $XDG_DATA_HOME/cotp.
If not, set the hard coded prefix to .local/share/cotp

In-UI HOTP counter incrementation/decrementation

To increment/decrement the HOTP counter just press '+' or '-'.

Search codes with Ctrl + F

Use Ctrl + F key combination will allow you to to filter issuers/labels and etc.

Page Up/Page Down navigation

Use Page Up/Page Down key to navigate to the previous/next page.

The following texts are for the in App help menu

Press:
Arrow Up/Arrow Down -> Previous/next element
Page Up/Page Down -> Previous/next page
Enter -> Copy the OTP Code to the clipboard
k -> Show QR-Code of the selected element
CTRL-F -> Search codes
CTRL-W -> Clear the search query
+ -> Increment the HOTP counter
d -> Delete selected code
Esc/q -> Exit

Question,Does it support piping to other app in.

If possible,I wanted to pipe the output from this cli app to my own homemade app.
of example like a java calendar app used along with encryption then run this app and try get the output and verify as 2FA.
for example using,https://github.com/samdjstevens/java-totp
comparing to cotp values.

Feature Request: A search feature to select issuer/label

I think a useful feature would be to be able to do a find search to select issuer/label with ctrl + f and/or /

Also one minor thing:
I think it would be nice if k were moved off this bind:
k -> Show QRCode of the selected element
and instead using k/j as vim alts for ↑/↓ would be better/more universal imo

Add protocol URL support to `cotp add`

Would be better ux, and would allow it to work directly with decoded QR codes

"otpauth://$TYPE/$ISSUER:$LABEL?algorithm=$ALGORITHM&digits=$DIGITS&issuer=$ISSUER&period=$PERIOD&secret=$SECRET"