search

scito / extract_otp_secrets

Extract one time password (OTP) secrets from QR codes exported by two-factor authentication (2FA) apps such as "Google Authenticator". The exported QR codes from authentication apps can be captured by camera, read from images, or read from text files. The secrets can be exported to JSON or CSV, or printed as QR codes to console.
https://scito.ch/content/extract-secret-keys-google-authenticator-qr-export
GNU General Public License v3.0
1.16k stars 138 forks source link

Restore keys from TWRP backup #24

Closed chertov closed 1 year ago

chertov commented 1 year ago

Today a column in /data/data/com.google.android.apps.authenticator2/databases/databases is encrypted. Is it possible to get private key from backup and decrypt keys?

scito commented 1 year ago

I have no idea.

The extract_otp_secret_keys script works only with QR exports from the app. The secrets are already decrypted.

brand1970 commented 1 year ago

I tried importing the decrypted keys into a new database (not the encrypted keys ) with a command line via sqlite3 and it works. The headers of the file "/data/data/com.google.android.apps.authenticator2/databases/databases" (type .db) is : 0|_id|INTEGER|0||1 1|email|TEXT|1||0 2|secret|TEXT|1||0 3|counter|INTEGER|0|0|0 4|type|INTEGER|0||0 5|provider|INTEGER|0|0|0 6|issuer|TEXT|0|NULL|0 7|original_name|TEXT|0|NULL|0

scito commented 1 year ago

I tried importing the decrypted keys into a new database (not the encrypted keys ) with a command line via sqlite3 and it works.

I do not understand what you want to achieve. How did you decrypt the keys?

brand1970 commented 1 year ago

I did a simulated restore, nothing more... When restoring I didn't use the secret keys but the decrypted ones which anyone can find either with https://play.google.com/store/apps/details?id=com.beemdevelopment.aegis&hl=en ( https://github.com/beemdevelopment/Aegis )

shokolatha commented 1 year ago

Aegis only decrypts databases of Google Authenticator prior to version 5.10, not the updated versions. Without the decrypted keys you can't recreate a new database file. So that's not a correct answer to chertov's question.

I did a simulated restore, nothing more... When restoring I didn't use the secret keys but the decrypted ones which anyone can find either with https://play.google.com/store/apps/details?id=com.beemdevelopment.aegis&hl=en ( https://github.com/beemdevelopment/Aegis )

scito commented 1 year ago

I think nothing can be done within the extract_otp_secrects script. Thus, I close this issue.