nyuad-spammer

I was going to add something on Duo before seeing that. If you have to use OTP with it, rather than FIDO, which I guess costs more, as my site doesn't support it, the hacks are fairly straightforward. On an Android phone, register a "tablet" (at least in the interface I see) using https://f-droid.org/en/packages/net.scintill.duotp/ and then use Aegis with the secret. (Why do people persist on suggesting Google Authenticator?) On a desktop, see https://github.com/simonseo/nyuad-spammer/tree/master/spamme... with an appropriate value of "start.nyu.edu". I use the secret with pass otp. Note that this is HOTP, not TOTP, so if you use the same secret on multiple devices, you need to synchronize the counter somehow, perhaps with a git hook under pass. (There are more baroque hacks to get the secret that I started with before finding thos

At least for Duo, you can extract the HOTP secret [1] and use it in any OATH tool, e.g. with the otp extension of pass(1) on GNU/Linux (which uses uses oathtool(1) underneath). You can also do it a more difficult way, e.g. using the Duo app under anbox. 1. https://github.com/simonseo/nyuad-spammer/tree/master/spamme...

I found https://f-droid.org/en/packages/net.scintill.duotp and https://github.com/simonseo/nyuad-spammer/blob/master/spamme... only after extracting the secret from a throwaway Duo app's storage.

I found a better method, actually. Someone reverse engineered the app. Actually very simple. https://github.com/simonseo/nyuad-spammer/tree/master/spamme...