Re: New package for NonGNU ELPA : totp-auth

[Jean Louis <bugs@gnu.support>]

* Jean Louis <bugs@gnu.support> [2024-02-12 23:19]:
> * Morgan Willcock <morgan@ice9.digital> [2024-02-08 22:16]:
> > I imagine this is potentially leaking your keys by making them visible
> > in the system's process information.
> 
> > Recent versions of oathtool can read the key from stdin, so any attempt
> > to create a wrapper should probably be using this feature.

I use my command here to to go easier with pipes.

(defun rcd-command-output-from-input (program input &rest args)
  "Return output string from PROGRAM with given INPUT string and optional ARGS."
  (let* ((output (with-temp-buffer
		   (insert input)
		   (apply #'call-process-region nil nil program t '(t nil) nil args)
		   (buffer-string))))
    output))

Then I have modified it to read from input:

(defcustom rcd-oath-keys ()
  "List of OATH keys."
  :type '(alist :key-type string)
  :group 'rcd)

(defun rcd-oath ()
  (interactive)
  (let* ((key (rcd-choose (map-keys rcd-oath-keys) "OATH Service: "))
	 (program "oathtool")
	 (result (rcd-command-output-from-input program (symbol-name (alist-get key rcd-oath-keys nil nil 'equalp)) "-" "-b" "--totp=sha1"))
	 (result (string-trim result)))
    (message result)
    (kill-new result)))

But I am not sure if it can be seen in process list this way. What do
you think?


Jean

Take action in Free Software Foundation campaigns:
https://www.fsf.org/campaigns

In support of Richard M. Stallman
https://stallmansupport.org/