init

Author: Quang Luong

.gitignore

@@ -0,0 +1,126 @@
+# Created by .ignore support plugin (hsz.mobi)
+### JetBrains template
+# Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm, CLion, Android Studio and WebStorm
+# Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839
+
+# User-specific stuff
+.idea/**/workspace.xml
+.idea/**/tasks.xml
+.idea/**/usage.statistics.xml
+.idea/**/dictionaries
+.idea/**/shelf
+
+# Generated files
+.idea/**/contentModel.xml
+
+# Sensitive or high-churn files
+.idea/**/dataSources/
+.idea/**/dataSources.ids
+.idea/**/dataSources.local.xml
+.idea/**/sqlDataSources.xml
+.idea/**/dynamic.xml
+.idea/**/uiDesigner.xml
+.idea/**/dbnavigator.xml
+
+# Gradle
+.idea/**/gradle.xml
+.idea/**/libraries
+
+# Gradle and Maven with auto-import
+# When using Gradle or Maven with auto-import, you should exclude module files,
+# since they will be recreated, and may cause churn.  Uncomment if using
+# auto-import.
+# .idea/artifacts
+# .idea/compiler.xml
+# .idea/modules.xml
+# .idea/*.iml
+# .idea/modules
+# *.iml
+# *.ipr
+
+# CMake
+cmake-build-*/
+
+# Mongo Explorer plugin
+.idea/**/mongoSettings.xml
+
+# File-based project format
+*.iws
+
+# IntelliJ
+out/
+
+# mpeltonen/sbt-idea plugin
+.idea_modules/
+
+# JIRA plugin
+atlassian-ide-plugin.xml
+
+# Cursive Clojure plugin
+.idea/replstate.xml
+
+# Crashlytics plugin (for Android Studio and IntelliJ)
+com_crashlytics_export_strings.xml
+crashlytics.properties
+crashlytics-build.properties
+fabric.properties
+
+# Editor-based Rest Client
+.idea/httpRequests
+
+# Android studio 3.1+ serialized cache file
+.idea/caches/build_file_checksums.ser
+
+### Kotlin template
+# Compiled class file
+*.class
+
+# Log file
+*.log
+
+# BlueJ files
+*.ctxt
+
+# Mobile Tools for Java (J2ME)
+.mtj.tmp/
+
+# Package Files #
+*.jar
+*.war
+*.nar
+*.ear
+*.zip
+*.tar.gz
+*.rar
+
+# virtual machine crash logs, see http://www.java.com/en/download/help/error_hotspot.xml
+hs_err_pid*
+
+### Java template
+# Compiled class file
+
+# Log file
+
+# BlueJ files
+
+# Mobile Tools for Java (J2ME)
+
+# Package Files #
+
+# virtual machine crash logs, see http://www.java.com/en/download/help/error_hotspot.xml
+
+### Gradle template
+.gradle
+/build/
+
+# Ignore Gradle GUI config
+gradle-app.setting
+
+# Avoid ignoring Gradle wrapper jar file (.jar files are usually ignored)
+!gradle-wrapper.jar
+
+# Cache of project
+.gradletasknamecache
+
+# # Work around https://youtrack.jetbrains.com/issue/IDEA-116898
+# gradle/wrapper/gradle-wrapper.properties

.idea/$CACHE_FILE$

@@ -0,0 +1,45 @@
+# How to use
+
+* Audit the code, reverse the binary (seriously, don't just trust me)
+* Go to the website that manages 2FA
+  * e.g. not-start-portal, not-some-university portals
+* Add a new phone
+  * Input your phone number and those kinds of stuff
+  * Just choose Android (you are gonna use different 2FA client anyway)
+  * Do not use the QR code. Choose the option which sends the activation
+    link to your email
+  * The continue button is disabled, for now)
+  * You should see the link of the form
+    `https://m-xxxxxxxx.duosecurity.com/android/XXXXXXXXXXXXXXXXXXXX`
+    * If you don't, just click on the link and check the url bar
+    * Copy it
+* Run the application (in the `bin` directory)
+  * Paste the link in
+  * Wait
+  * Click continue on the web page (not it should be highlighted)
+  * Copy the hopt secret and use it with whatever authenticator you
+    want. (Note: Duo uses *counter based* hopt)
+    * Example: you can use
+      [this extension](https://github.com/Authenticator-Extension/Authenticator)
+      in browser
+      * Edit -> Manual Entry
+      * Counter based; name = any thing; secret is the hopt you get from
+        the app
+      * Done. Now you can get your passcode right in your browser
+
+# Is this secure?
+
+No. Just like the Duo App. (you should not use the browser extension by the way; but if you do remember to set the password or encrypt it)
+
+# Alternative (preferred) methods
+
+Duo allows using FIDO devices to authenticate (that is actually more
+secure than using phones tbh). It also supports TouchID (only Apple and Chrome).
+However, ~~i am broke~~ another solution supporting all platforms is using a
+u2f emulation -> add u2f devices to Duo
+
+* Linux: https://github.com/danstiner/rust-u2f (remember to set udev rules depending on your distro)
+* Win: https://github.com/SoftU2F/SoftU2F-Win
+* Mac: https://github.com/github/SoftU2F
+
+[![Donate](https://img.shields.io/badge/Donate-PayPal-green.svg)](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=C44YKYMVNL4TA)