skarbiec totp missing

Invocation#

skarbiec totp missing

Purpose#

Find the accounts guarded by a password alone although their site offers authenticator codes, so a second factor is set up where it is one setting away.

Required inputs and options#

• No arguments. Which sites offer codes is read from the 2FA Directory's published list of sites offering RFC 6238 codes, https://api.2fa.directory/v4/totp.json, downloaded with curl; nothing from the vault is sent. POST /v1/operator/items/codes-missing takes no body.

Output and state effects#

• Opens every live login, skips the ones whose totp_secret holds a seed, and matches the sites each one's context names against the directory, a site matching its subdomains too. Prints ok (false when a login is listed or would not open), logins (each item with sites: the directory's site and setup, the site's own two-factor setup page where the directory names one), unreadable (each login that would not open, with its error), source (the list's address) and attribution, the 2FA Directory's attribution its MIT license asks for. Writes nothing; `totp set <id>` stores the seed once the site shows it, and Desktop's Settings → Policy shows the list as Logins without a code.

Refusals#

• Any argument exits 2 with `usage: totp missing`. A directory that cannot be reached fails with `the 2FA Directory at <address> could not be read (<curl status>): <curl's reason>; no login was judged`, and an answer that is not the directory's object of sites with that shape named. Passwords and seeds never appear in the answer.