Duo Datamining Mandate

My school is requiring all students to use the "DUO" multifactor authentication app. I would rather pull all the skin off my arms than agree to this: https://help.duo.com/s/article/4683 > Duo never sells your data. We only use your data to provide and improve our security service. :) > With Android 12 and up, you may intermittently see the message stating "Duo Mobile pasted from your clipboard." Duo Mobile uses the clipboard to support our Trusted Endpoints functionality. > If you have any questions related to data collection and use that is not covered by this article, please see the Cisco Online Privacy Statement … > The types of Personal Information that we may process … may include: … Online behavior and product usage information; > Details of an individual’s business and other interests and opinions …; and > Information about the user of our products and services, including System Information such as device identifiers, and telemetry (such as IP or MAC address) when such data is linked or tied to a specific person’s device. > We may collect data, including Personal Information, about you as you use our … Solutions and interact with us. We also acquire Personal Information from trusted third-party sources and engage third parties to collect Personal Information on our behalf. > We may use your Personal Information for the purposes of … improving, and customizing our websites and Solutions, sending … marketing and other communications, and for other legitimate purposes permitted by applicable law. > We collect Personal Information for a variety of business reasons, such as: … Analyzing, personalizing, improving accuracy, and enhancing user experience, communications, and interactions; My much preferred option, to "secure" my network account against the rampant phishing scams that the business majors keep falling for, is to (continue to) pre-calculate IETF RFC 6238 codes with pencil and paper whenever I am going to a class that requires using a school computer. It looks like DUO does support* these: https://duo.com/docs/administration-devices#importing-third-party-hardware-tokens *From what I've read online, it seems like the only problem with their support for TOTP is they refused to implement server-side drift correction. Also, random 3rd-party vendors do sell Duo-compatible hardware TOTP tokens: https://www.proteccionsoftware.es/media/catalog/pdf/Feitian_Duo_Security_Integration_Guide_V1.1.pdf https://www.token2.com/shop/page/using-token2-totp-hardware-tokens-with-duo While I am strongly considering buying one of those dedicated, comparatively "dumb" devices as a less painful alternative, I would much rather "pretend to have one", send the office of I.T. a CSV representing this imaginary token plus the administrative support article above, and continue calculating the TOTP codes myself. However: I cannot figure out how to map between Duo-compatible TOTP “serial numbers”, and the actual inputs for the hash! Does anyone know this mapping?

For the sake of completeness, I'll note other allowable authentication methods than Duo-App and TOTP: > receive a phone call > receive a text message > tell the IT helpdesk I "misplaced my device" and request something like an HOTP from them The first 2 of these require carrying a cell phone on me at all times. if it's a smartphone, I will die; if it's a "dumb" phone that isn't able to weasel communications through Wi-Fi, then many campus buildings block reception indoors. The third requires obnoxious interactions on an indefinitely recurring basis.

You can emulate these things if you really want to be obstinate. From the looks of this, I would probably just buy a U2F key for $10-20.

>>69221 >You can emulate these things if you really want to be obstinate. Given that their app's "trusted endpoint" functionality is aggressively scrubbing every device metric it can get its hands on, I would be surprised if that works— similarly to running banking apps in an emulator, "secure" app development usually means putting DRM-like code in there to block non "genuine" devices. Also, from what I've read, the app doesn't offer any way to pre-generate codes, and the codes it does offer are the worst of both worlds (not generated offline and time-restricted in nature), so even just spoofing the system clock wouldn't be a usable workaround anyway-- i.e. even if the app can be emulated it won't actually be usable there. >From the looks of this, I would probably just buy a U2F key for $10-20. Sadly, it looks like that's something they only support during internet outages, and the admins have to especially allow it? https://duo.com/docs/rdp#offline-access (U2F is in contrast with TOTP, the latter which appears to be something that can be configured by any helpdesk technician on out-of-the-box Duo systems.) All this to say: I am still very curious what the conversion/correspondence is between these 3rd-party "TOTP hardware tokens" and the actual TOTP standard. I ordered one of these things, but it'll be a while before it's arrived. And even after this conversion's no longer a practical necessity, I really would like to know just out of curiosity, given that several hours of Google-Fu have failed to turn up anything enlightening.

Why not just put it into a android vm ?

>>69229 1. That requires either hauling a smartphone around with me anyway and suffering through the pain of a VNC connection, or a bringing a laptop to class (which would make the exercise, then, pointless, since I don't generally need to log on to school equipment if I've brought my own.) 2. I can't test it yet since they haven't enabled student accounts up for Duo yet, but I do predict that the Duo app will reject being run in a VM anyway

After much searching, I found this [attached] script from some generous guy on Reddit It hasn't been touched in 3 years, and I haven't tested it myself yet (I don't know Go yet; I'll be translating it into Python while I wait for my school to turn on access to Duo's portal)

>>69230 I run the Duo Mobile app on a VM on my laptop. They require it to let me log in to the university's supercomputer cluster but everything else I can just use OTP's they text me.

>>69232 More prior art-- once I realized that they easily expose an HOTP secret, it got a lot easier to find result https://som.codes/blog/2021-06-08/duo-mobile-hotp/ (Using this "self-serve", hacked HOTP instead of TOTP also, in Duo's current ecosystem, has the advantage of not having to convince the helpdesk to import a CSV file for my special snowflake self, which could be nice if they decide to be unwilling on that front.) Also, after looking into the TOTP system, it turns out that the vendors e-mail you the corresponding secret after order. -_- So that's my curiosity satisfied on that front... and neither the Issuer nor Account fields are inputs to the hash, so it looks like the "Serial Number" field has no bearing on anything; it's just a comment, essentially.

>>69235 Sounds like you figured out how TOTP works. Here's what I use to ditch the duo app - https://gitlab.com/oath-toolkit/oath-toolkit Yes, you do need the secret. Get your hands on it somehow. If they email it to you, that's great. It is also possible to export it from the duo app itself if you have no other option available. Build oath-toolkit from source. Install it however you'd like. Then when you want a 6 digit code, run `oathtool --totp -b $SECRET`, where secret here is your TOTP secret. fuarrrk duo. Spread this to your school friends.