8

iOS Passwords application/pane (since version 15?) has 2FA codes (TOTP), and here's an example:

iOS Passwords

Here I'm using Instagram as an example, because one can enable 2FA for his account only via their mobile application and without a chance to use any other password manager but the system one, as you never see the QR code or TOTP secret. At least that was the case for me on iOS.

How can I now extract the TOTP secret of that code (a value in the format like DKFUOLOFUJTDWKIEIS2LZRWGUFZOOAW9), so it could be stored in other password managers, such as KeePassXC, Google Authenticator, Microsoft Authenticator, etc.?

I can also see the code in the Passwords tab in Safari on Mac OS, so at least it is synced there, and my iPhone isn't the only place where I have it:

Mac OS Passwords

And theoretically it should be easier to perform the extraction on Mac OS, as, unlike iOS, there is a proper access to the filesystem.

Is there a mechanism to get these secrets back out (iOS or Mac OS or web) as plain text after ingesting them to the iCloud Keychain?

Improve this question

1 Answer 1

Reset to default
8

Oh well, just before submitting the question, I remembered that Safari supports exporting passwords to a plain-text CSV file. So I did File → Export → Passwords..., and the TOTP secret was present in the resulting Passwords.csv:

www.instagram.com (USERNAME),https://www.instagram.com/,USERNAME,PASSWORD,,otpauth://totp/Instagram:USERNAME?secret=DKFUOLOFUJTDWKIEIS2LZRWGUFZOOAW9&issuer=Instagram

And I've successfully added it to another password manager.

Improve this answer
5
  • 1
    Did you just put your TOTP-secret in plain text visible for everyone to see?
    – Psi
    Commented Jun 29, 2022 at 14:16
  • 1
    I sure did, you can now go ahead and use it, I absolutely allow that.
    – retif
    Commented Jun 29, 2022 at 19:32
  • i just wanted to point out that if this is your actual instagram TOTP secret, your just undermined the 2FA security of your account
    – Psi
    Commented Aug 19, 2022 at 11:10
  • I'd reckon that goes without saying, it's hard to imagine a person with such a task at hand who would not have a clue about what this secret is for and whether he should share it with anyone but himself.
    – retif
    Commented Aug 20, 2022 at 16:44
  • 3
    I’ve seen people post pictures of their amazon gift cards and similar stuff… better safe than sorry. I’d rather take the risk to point out something obvious than having this person uninformed about the consequences of their actions
    – Psi
    Commented Aug 20, 2022 at 17:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .