There may be a desktop time issue in KDE3 that causes different TOTP gen between keepassxc GUI and CLI
All, I ran across this strange bug building keepassxc on a 15.4 box. The build failed at TestPasskeys check which led to updating libbotan and libbotan-devel to 2.19 and the build issue was fixed. However, here is the bizarre part. With keepassx 2.7.6 and now with the fresh 2.7.8 with the GUI, I get different TOTP codes generated using the keepassx-cli command line in konsole and using the keepassx GUI. For example, in the keepassxc GUI, I got the following TOTP (times the same to the second): 176393 From the CLI, I get a completely different TOTP, e.g. $ keepassxc-cli show -t ~/.config/xxxxx.kdbx -k ~/.config/xxxxx.key "/Internet Sites/accounts/GitLab - Archlinux" Enter password to unlock /home/david/.config/xxxxx.kdbx: 103475 The CLI TOTP is correct, the GUI generated one is not. I ran into the TOTP issue a few weeks ago when gitlab just stopped accepting my TOTP codes as "Invalid". After stumbling across the build failure, I figured out the keepassxc-cli generate TOTP works fine with gitlab. I had opened a keepassxc issue on the build failure (the TestPasskeys check failure) which led to discovering the libbotan issue and comes down to this. The GUI and CLI use the same code to create the TOTP, the only possible difference is the time between the console and time reported by the desktop environment. If there is some strange zoneinfo, etc.. issue lingering in KDE3 that is just now manifesting, we may see more of this type issue. You can read the full discussion of the build and then GUI/CLI TOTP disagreement in this issue on github: https://github.com/keepassxreboot/keepassxc/issues/10854 I thought I would post here before I missed the chance, just in case there is some desktop time/system time issue. I've never seen anything like this before and checking the environment, the only thing I see time related is "COMPREPLY" that I'll have to look at further. Just make a note of this post if you run into anything funny time related in the future, this may give a starting point for debugging. I'll update if I find more on the issue I'm having. -- David C. Rankin, J.D.,P.E.
-------- Forwarded Message -------- Subject: There may be a desktop time issue in KDE3 that causes different TOTP gen between keepassxc GUI and CLI Date: Sun, 2 Jun 2024 20:41:39 -0500 From: David C. Rankin <drankinatty@gmail.com> To: suse-kde3 <kde3@lists.opensuse.org>
All,
I ran across this strange bug building keepassxc on a 15.4 box. The build failed at TestPasskeys check which led to updating libbotan and libbotan-devel to 2.19 and the build issue was fixed.
However, here is the bizarre part. With keepassx 2.7.6 and now with the fresh 2.7.8 with the GUI, I get different TOTP codes generated using the keepassx-cli command line in konsole and using the keepassx GUI.
After building the new keepassxc wtih the updated libbotan, the TOTP mismatch in the GUI turned out to be an ID-10-T moment where dislyxia or plain old Murphy's Law applied. In the GUI from imports and additions there was an entry for "Archlinux Gitlab" and well down below an entry for "Gitlab Archlinux".... Never say "it could never happen to me...". Now which one has the correct recovery codes? -- David C. Rankin, J.D.,P.E.
participants (1)
-
David C. Rankin