gotp
gotp copied to clipboard
tschuy
[Preliminary] Add HTTP server for remote access to TOTP token
Intended usage: Add an auth proxy on top of the service. Two factor tokens can then be shared between members of a team without giving the token secret to each individual.
This is a preliminary pull request adding support for serving tokens over HTTP. Its main problem right now is that it handles encryption poorly (which is... a minor issue for a tool that is based on encryption).
Right now, gotp requires gpg-agent to be running. If it's not, it'll error out (as part of the detection in #2). However, if there's no password on the key, it'll be perfectly happy to use the key to decrypt/encrypt a token. My other thought was to store the passphrase to the gpg key as a secret in an environment variable, but i'm not sure how much good that would do us.