Summary of Time-based One-time Password fob for Google Authenticator
This article describes creating an OTP fob using an Espruino Pico with beta HID support to mimic a YubiKey. The device sends time-based auth codes to Windows, Linux, or Mac PCs upon button press. Key requirements include specific firmware, Web IDE settings for accurate time, and the Google Authenticator secret.
Parts used in the Espruino Pico OTP Fob:
- Espruino Pico
- Web IDE
- jsSHA library (JavaScript implementation of SHA/HMAC)
- Generate Time-Based One-Time Passwords code
- Espruino HID Example code
- Google Authenticator Secret
- Recent pre-release Firmware
Creating an OTP fob compatible with Google Authenticator using an Espruino Pico
Now that the Espruino Pico has (beta) HID support, it can pretend to be a keyboard or mouse (or other HID compatible device). This makes it possible to send characters to the active window on your Windows/Linux/Mac PC. I’ve cobbled together some code which turns the Pico into a device like a YubiKey. Press the button and get the latest auth code pasted automatically for you.
Now that the Espruino Pico has (beta) HID support, it can pretend to be a keyboard or mouse (or other HID compatible device). This makes it possible to send characters to the active window on your Windows/Linux/Mac PC. I’ve cobbled together some code which turns the Pico into a device like a YubiKey. Press the button and get the latest auth code pasted automatically for you.
This code is basically just from three sources, merged together with a few tiny tweaks by me.
- jsSHA, a JavaScript implementation of SHA/HMAC
- Generate Time-Based One-Time Passwords With JavaScript
- Espruino HID Example
(Note I’ve just discovered that Espruino has its own hmac implementation so I can possibly drop jsSHA)
The main thing you need for this is your Google Authenticator Secret. Unfortunately you can only get this when you have access to the original QR code that you scanned (it’s in the URL). But if you are setting up 2FA access to a new service e.g. Digital Ocean, then you can grab the secret and save it in the code. If your system also uses a PIN (e.g. SSO on some corporate sites), save that in the code too.
You’ll need a very recent pre-release Firmware for this to work at all e.g. from here
Once that’s flashed, go into Settings on the Web IDE and make sure “Set Current Time” is ticked in the Communications section. Auth Fobs rely on having an accurate time and that setting keeps unsetting itself on my PC.
Now copy the code below onto the Espruino using the Web IDE and then type save() to make sure it can survive a power-cycle. Remove and re-insert the Pico, press the button and you should get the auth code you need.
Now for the bad news: This currently doesn’t work on my Windows 8.1 PC but works semi-reliably on my work MBP. Once the HID code makes it to production, I’m sure it will work fine.
Read more: Time-based One-time Password fob for Google Authenticator
- What is the main function of the Espruino Pico in this project?
The device pretends to be a keyboard to send the latest auth code to the active window on a PC. - How can I obtain the Google Authenticator Secret?
You can only get it from the original QR code URL or save it during setup for new services. - Does this project work on all operating systems?
It works semi-reliably on Mac but does not currently work on Windows 8.1 according to the author. - What setting must be enabled in the Web IDE?
The Set Current Time option must be ticked in the Communications section to ensure accurate time. - Can I use Espruino's built-in HMAC instead of jsSHA?
Yes, the author notes that Espruino has its own hmac implementation which could replace jsSHA. - How do I ensure the code survives a power cycle?
Type save() after copying the code to the Espruino using the Web IDE. - What type of device does the Pico emulate in this setup?
The Pico emulates a HID compatible device like a YubiKey. - What happens when you press the button on the Pico?
The latest auth code is automatically pasted into the active window.
