OTP in pass-otp - passwords

I have a question as I use pass: the standard unix password manager with the plugin pass-otp.
I also generate the OTP in Google Authenticator and sometimes the generated codes differ even though the input (secret) and the algorithm are the same.
Since it's also based on time I've sync both devices (Linux PC and Android phone). However, I still get different codes. Any ideas why?

Ok, I came to sad conclusion that was overlooked but fixed as soon as I fired off systemctl start systemd-timesyncd - my system wasn't synced and was approximately running with 1 min delay. Therefore the sequence was sometimes valid and on the list of generated codes from the phone.

Related

How to figure out that two apps are on the same device on macOS(Alternative of identifierForVendor in macOS)

advertisingIdentifier is different for apps from the same vendor.
Of course there is an ability to add apps into group and share some "unique string". But I suppose that there must be some easier way.
I also read about "Uniquely Identifying a Macintosh Computer" but I suppose that such apps are rejected in mac AppStore.
In our app we access the system serial number. We use it to try prevent multiple users using the same account + for debug purposes (so not for ads or anything, our app has none).
We also have code to access the hardware uuid but that code isn't actually used at the moment, but it is in there, so not sure how deep Apple checks. So you might be able to use this one too. As an additional step you could hash either of these (or hash them appended or something).
This app has been on the AppStore for a long while now, and was never rejected for this reason. So I'd say accessing this data on macOS should be ok (for now) depending on usage and safe to submit to the app store.
Keep in mind that in some rare cases, the serial number will not be available. In that case we store a random string in UserDefaults.standard and use that cached value in the future.
Since this information won't be available to your 'other' app(s), this workaround won't work for you though.

J2ME system notification / play sound when phone is locked

Good day all,
I have a java based phone (samsung star 2 5260) and it's three weeks that I'm trying to come up with a solution to receive notification on received emails.
The phone configures a periodic check for a minimum of 30 minutes, but I need a much more frequent control (five minutes maximum).
I have tried countless solutions, and I've come up with the closest one, being a custom mujmail midlet that supports my gmail mailbox over imap, deployed thanks to the netbeans editor.
Point is, I've modified mujmail's polling to run on the background, but audio does not play when the phone is locked, so even if the midlet checks and receives emails, it's unable to notify me. The application minimizes and keeps on running, but it's unable to tell me that new mail has arrived.
I've even tried sending an sms when there's new mail, but was unable to sign the application (looks like ktoolbar produces 1024 bit certificates, and thawte, verisign, etc. will only produce 2048 bit certs since a few years.), and so it'll always ask authorization, which renders this approach useless.
So I'm desperate to find an alternative.
And I was hoping that we can in some way emulate the 'system alert' that the phone uses when it's locked and you receive an sms (audio cue).
Is this a j2me functionality, or is it specific to the samsung sdk?
Does anybody have an idea of how to access this functionality from inside a midlet?
Is there a way to create a midlet in the trusted third party domain without signing it?
I know j2me is an old subject, but hopefully someone here is still knowledgeable about it.
Thanks in advance.
Looks like you're expecting too much from JavaME.
If it's possible to do what you want, you can be certain that it requires signing.
Basically you have to sign your MIDlet with a certificate that is supported on your phone. Most developers go for Thawte or Verisign, because their certificates are supported on the most devices.
If you're only interested in getting this to run on your own phone, it's possible you can find a much cheaper provider, like e.g. Samsung themselves. But I admit I don't know.
In any case, there's no way around signing, when you want to do things like this with JavaME.
(Well.... there's a tiny slim chance that your phone lets you set permissions, like "Never ask" in the MIDlet properties on the phone after installation, but only a tiny slim chance).
Even after signing your MIDlet, it still won't be able to wake up the phone. JavaME is a sandbox. If the user puts the phone to sleep, then JavaME can't wake it up. (At least not without special API's, which I don't think exists).
If it was me, I'd investigate this approach:
Implement PushRegistry timer to launch the MIDlet ever 5 minutes. This should theoretically launch the MIDlet despite the phone sleeping. (But not if it's turned off).
Then attempt if you can play an alarm sound here.
If you can't, then I'd look into sending an SMS to myself.

What is the standard method for writing a continuously running app that is allowed on the Mac App Store

I'm brand new to OS X and mac programming. I'm looking to write an app that runs continuously or is woken up every 30 seconds to do some minor task. It would do something like check the weather via a web service and shoot off an email if the temperature drops below freezing. In Windows I would just use a service or put a repeating task in the task scheduler. Is there a standard way to accomplish this in OS X which the mac app store allows? I would like to write something that I can put in the store but Apple seems to have vague restrictions against running background processes.
I've learned a little about launchd but I can't tell if I am allowed to use it. Ideally the process would get run even when no one is logged in, but it probably won't need root access. If someone does happen to be logged in, it would trigger some popup if it sent an email temperature alert out. I would also have some GUI which the user would be able to modify the configuration files that determine the behavior of the background process. I don't anticipate any app store restriction for that piece of the project though.
I'm pretty sure an app that runs invisibly like that would not be allowed into the App Store. What you're going to want is to create a menubar-only application, which can be enabled by setting a key in your app's info, namely LSUIElement. Although it won't be able to be run unless a user is signed in, it's your only way to get it into the store successfully.
The MAS guidelines have several prohibitions that would impact you. Go to the guidelines and read section 2. In particularly consider 2.15, 2.23, and 2.27. I don't know any way to get your application running prior to login without at some point requesting admin privileges (even if you don't use the privilege when you run).
I would probably make it a Login Item (System Preferences>Users>Login Items), probably as an LSUIElement app as sudo rm -rf suggests. Definitely if it's your first app, I wouldn't go diving into launchd in any case. It is one of the most infuriating system processes I've ever dealt with.

Time limited Shareware

I'm thinking about making a time limited full version of my App, so users can try it for example 7 days.
Is there a recommended Obj-C library?
First of all do not store your data inside the app. Otherwise it would be simple to delete the App from the filesystem and download it again restarting the countdown. Store it in User preferences or Application Support instead. You could use a plist for this. You could also use a hidden file if you like. Just don't make it too complicated or too invasive. Your app can be cracked no matter what security measures you use in the end. Just be fair enough to the end user that could be a prospective customer.
Here is a very nice link on the topic of implementing a time-limited trial in Cocoa:
http://lipidity.com/apple/shareware-licensing-techniques/
Without possibility to protect your data from manipulation/deletion it is not possible to do.
How do yo check, if it is first start of your application, if all your data is wiped out.
Some alternative is "hardcoded" id token and connection to the rest of world (at least for first start, to grab any kind signed data key)
Maybe you could use a server where store UUID's and first time they launched the App. Then, Each time they open your application, it asks your server if they can use it or not. It's harder than store dates on device but if you do that, users will access your application simply changing the date of the device on Settings.

Avoid running of software after copying to next machine?

I have developed a small software. I want to provide and run it commercially only. I want it to be run in the machines who have purchased it from me.
If someone copies it from my clients computer and runs it in next computer, I would like to stop functioning/running the software.
What can be the ways to prevent the piracy of my software?
Adaption of one of my previous answers:
There are a few ways to "activate" copied software to try to stop casual copying of the application.
In the most simplistic case, a registration code ("CD key") purchased from you, possibly via your website, and it is sent to the user who enters it into the program or installer. The whole process can basically be done offline; the program itself locally determines that the code is valid or invalid.
This is nice and easy, but it extremely vulnerable to key sharing - since there's no "phoning home" then the application cannot know that thousands of different people are all using the same key that they got off the internet or a serial library or their friend. It's also reasonably easy to make "keygens" which generate valid-seeming keys that were never actually issued by the developers.
Then we get into online registration. You still have some kind of code, but the program will phone home back to the server to determine whether the code is valid and usually unique. This stops basic key sharing, because the company knows if too many people from all over the world are all using the same key. Perhaps there is some kind of identification involved using MAC address, too, with infinite registrations allowed on the same hardware but maybe a limited number on what appears to be a different computer.
This is still pretty easy and stops simple key sharing. People will actually have to get into cracking the software or faking the server response to get past it.
Sometimes the program itself is partially/mostly encrypted and is only decrypted by the online registration step. Depending on how well this is obfuscated then it can be pretty difficult and time consuming to crack. Bioshock was a high-profile example of this - debuting with a brand new encryption/copy protection scheme that took around two weeks from release to be broken.
Finally, a particularly guarded application might stay in constant contact with the server, refusing to work at all if the connection is severed.
If you know for sure that all your users will all have reliable internet connections then it can be considered quite a strong way to protect the app, at the cost of privacy and some user distrust of the spyware.
In this case to get around the activation they would need to fake the server itself. Steam emulators and private WoW servers are an example of this.
And in the end, nothing is uncrackable.
In a nutshell: you can't.
Even very sofisticated systems (e.g. dongle keys) can be circumvented.
I guess your best call is to give a code to your customers and have an online check for that code, so that it cannot be used twice.
Of course, that can be circumvented too but...
As nico said you really can't.
A simple solution might be to generate (registration/activation) codes that are based on hardware or software installed on the particular computer - eg video card serial id or c:/windows creation time.
I have one idea may be it works.
What we can do, we will make an encorrupted database field and that field will be empty for the first time as soon as i install my software to some machine it will read the Mac Address + Mother Board Serial + Processor ID and make an encorrupted value with the combination of these three and write in to that field which i left empty for the first time use.
After that every time my application will read these three values and recreate the encrupptted value in the same manner and compare with the value of that database field. If the value of the database field and the value of the regenerated encrroupted field is equal, that means the computer is same other wise it is installed on some other machine in this case you delete all the code and can make the system unstable to punish the person also :) ...
Please let me know about your opinion about this idea.
The best way is to use some sort of hardware-locking in which your license code contains encrypted info about the machine on which it will run. Your software will then check for this info and match it with the current computer and if the match is successful, the license is deemed valid.
Sure, any scheme can be cracked by someone on the face of the planet, but that does not mean you shouldn't use a protection scheme.
If you are looking for a ready-made scheme for this, have a look at CryptoLicensing.
Companies such as ours (Wibu-Systems), Safe-Net, and Flexera (expensive) offer dongle-free solutions as well as ones based on hardware. But _simon was right in that a dongle is the only iron-clad protection. All software-based systems can be cracked; it's just that some are more difficult than others. Really good hardware-based solutions are effectively uncrackable. No one has yet cracked the CodeMeter stick unless the implementation was flawed.