Skip to content

Commit

Permalink
Rework github actions and documentation (#78)
Browse files Browse the repository at this point in the history
* They now use the v2 of checkout action
* Split them up into:
  * pr.yml: build and test for Pull Requests
  * ci.yml: renamed to pre-release.yml: will build and generate a pre-release containing the latest plgx.
  * tagged-release.yml: for creating a versioned release by pushing a tag (e.g. v0.103.0)
- Major overhaul of the documentation.
  * Split it up the readme.md into multiple docs, fixing typo's along the way. 
  * Added a section where people can find the latest release.
  * Updated release.md
  • Loading branch information
robinvanpoppel committed Apr 5, 2020
1 parent eff9dd2 commit 8626a1d
Show file tree
Hide file tree
Showing 11 changed files with 102 additions and 62 deletions.
4 changes: 2 additions & 2 deletions .github/workflows/pr.yml
Expand Up @@ -7,7 +7,7 @@ jobs:
runs-on: windows-latest

steps:
- uses: actions/checkout@v1
- uses: actions/checkout@v2

- name: Setup MSBuild.exe
uses: warrenbuckley/Setup-MSBuild@v1
Expand All @@ -32,4 +32,4 @@ jobs:
uses: actions/upload-artifact@v1
with:
name: KeeTrayTOTP.plgx
path: KeeTrayTOTP\bin\ReleasePlgx\KeeTrayTOTP.plgx
path: KeeTrayTOTP\bin\ReleasePlgx\KeeTrayTOTP.plgx
10 changes: 7 additions & 3 deletions .github/workflows/ci.yml → .github/workflows/pre-release.yml
@@ -1,15 +1,19 @@
name: KeeTrayTOTP CI Build
name: "KeeTrayTOTP Pre Release"

# Trigger on master, except when commit is tagged
on:
push:
branches:
- 'master'
tags-ignore:
- '*'

jobs:
build:
runs-on: windows-latest

steps:
- uses: actions/checkout@v1
- uses: actions/checkout@v2

- name: Setup MSBuild.exe
uses: warrenbuckley/Setup-MSBuild@v1
Expand Down Expand Up @@ -37,4 +41,4 @@ jobs:
prerelease: true
title: "Development Build"
files: |
*.plgx
**/KeeTrayTOTP.plgx
40 changes: 40 additions & 0 deletions .github/workflows/tagged-release.yml
@@ -0,0 +1,40 @@
name: "KeeTrayTOTP Tagged Release"

# Trigger on tags starting with v
on:
push:
tags:
- "v*"

jobs:
build:
runs-on: windows-latest

steps:
- uses: actions/checkout@v2

- name: Setup MSBuild.exe
uses: warrenbuckley/Setup-MSBuild@v1

- name: Setup Nuget.exe
uses: warrenbuckley/Setup-Nuget@v1

- name: nuget restore
run: nuget restore KeeTrayTOTP.sln

- name: MSBuild (With Plgx)
run: msbuild KeeTrayTOTP.sln /p:Configuration=ReleasePlgx

- name: Upload plgx
uses: actions/upload-artifact@v1
with:
name: KeeTrayTOTP.plgx
path: KeeTrayTOTP\bin\ReleasePlgx\KeeTrayTOTP.plgx

- name: Create release
uses: "marvinpinto/action-automatic-releases@latest"
with:
repo_token: "${{ secrets.GITHUB_TOKEN }}"
prerelease: false
files: |
**/KeeTrayTOTP.plgx
58 changes: 17 additions & 41 deletions README.md
@@ -1,55 +1,31 @@
# KeeTrayTOTP
Fork of the Tray TOTP Plugin for KeePass2.

Original work developed by the [Morphlin](http://sourceforge.net/u/morphlin/profile/) the source code and plugin can be found at http://sourceforge.net/projects/traytotp-kp2/

Most of consumer TOTPs use the RFC6238 output style, sadly some companies (eg.: Valve) decided not to adhere to the standard and instead build their own format.

In the case of Steam Mobile Authenticator the new output format was reverse engineered by various developers, and alternatives to it started popping up, most do pretty good job and can by themselves recover the TOTP secret (which is no easy task given Valve's implementation).

This plugin is for those who already use [Tray TOTP Plugin](http://sourceforge.net/projects/traytotp-kp2/), but also want to use with Valve's Steam.

## Dependencies
* [Keepass 2.31](http://keepass.info/)
* .NET 4.5 or superior

## So, why do this?
Variou reasons, first and most important: I don't want to use another application only for steam! KeePass and Tray TOTP (with some modifications) are more than capable enough to handle this task.
> This is a fork of the Tray TOTP Plugin for KeePass2. Originally developed by [Morphlin](http://sourceforge.net/u/morphlin/profile/). The source code and plugin can be found on [sourceforge](http://sourceforge.net/projects/traytotp-kp2/)
Second: for education, working with another developer's code , specially in a language you're not familiar with, its a difficult task but not uncommon situation.
Most of consumer TOTP's use the RFC6238 output style, sadly some companies (eg. Valve) decided not to adhere to the standard and instead build their own format.

Third: I wanted only to make a slightly modification, then I needed to make a new setting options, change the way plugin generate in order ta add another step, some rewriting later, too much was changed for simply patch, so I decided to create my own fork and made more changes

### Steam TOTP Secret?!
There is no easy way to get it, there are various complications. Since Steam doesn't setup like most services (using QR Codes), the easiest way is to have through a rooted android phone.

Another way would be using totp generators that support Steam like [Windows Authenticator](https://github.com/winauth/winauth) and [Steam Desktop Authenticator](https://github.com/Jessecar96/SteamDesktopAuthenticator), as far as I know, they emulate the mobile app API calls in order to generate a new TOTP Secret, one could use them to obtain the secret (never tried though), also this have the drawback of disabling the mobile app.

#### Obtaining TOTP secret from a rooted Android phone (by [DarkDaskin](https://github.com/DarkDaskin))
In the case of Steam Mobile Authenticator the new output format was reverse engineered by various developers, and alternatives to it started popping up, most do pretty good job and can by themselves recover the TOTP secret (which is no easy task given Valve's implementation).

You need a rooted Android phone with a file manager application and [Steam](https://play.google.com/store/apps/details?id=com.valvesoftware.android.steam.community) installed.
Follow [this instruction](https://support.steampowered.com/kb_article.php?ref=4440-RTUI-9218) to set up Steam Guard if you did not do this before.
## Releases

Then open the file manager and navigate to the `/data/data/com.valvesoftware.android.steam.community/files/` directory (requires root access). You will find a file named `Steamguard-[your Steam ID]` there, open it as a text file.
Inside the file look for the following text: `otpauth:\/\/totp\/Steam:[your Steam login]?secret=[TOTP secret]&issuer=Steam`.
Copy the value of `[TOTP secret]` info the *TOTP Seed* field of the *TOTP Setup Wizard*.
The latest release can be found [here](https://github.com/victor-rds/KeeTrayTOTP/releases).

TODO: Tutorial how to get Steam TOTP secret other ways
## Dependencies

#### Obtaining TOTP secret from an iOS backup
* [Keepass 2.31](http://keepass.info/)
* .NET 4.5 or superior

If you use an iOS device you can use a tool like the [iPhone Backup Viewer](http://www.imactools.com/iphonebackupviewer/) to extract the secret key.
1. Open the backup using such a tool
2. Find the Steam App: `com.valvesoftware.Steam` in `AppDomain`
3. Extract `Documents/Steamguard-[your Steam ID]`
4. Open the file using a text editor and look for the text `otpauth:\/\/totp\/Steam:[your Steam login]?secret=[TOTP secret]&issuer=Steam`.
5. Copy the value of `[TOTP secret]` info the *TOTP Seed* field of the *TOTP Setup Wizard*.
## Documentation

### What's next?
My first objective is complete: I made a working prototype.
But I'm not happy with the code, I want to rebuild this thing from the ground if needed, I'm by no means criticizing the original work, but it's little complex for me and rebuilding it may help to better understanding it.
Also I'm open to suggestion, issues, new features, etc.
* Obtaining Steam Secrets
* Via [Steam Desktop Authenticator](./secret_sda/steam_desktop_authenticator_sda.md) (by [@raabf](https://github.com/raabf))
* Via [Rooted android phone](./docs/secret_rooted_phone/index.md) (by [@DarkDaskin](https://github.com/DarkDaskin))
* Via [iOS backup](./docs/secret_ios_backup/index.md)
* [Release](docs/release.md)
* [History](docs/history.md)

**Thanks to [Dominik Reichl](http://www.dominik-reichl.de/) for KeePass software and to [Morphlin](http://sourceforge.net/u/morphlin/profile/) for the original plugin**
## Thanks

English isn't my native language, so please excuse any mistakes.
Thanks to [Dominik Reichl](http://www.dominik-reichl.de/) for KeePass and to [Morphlin](http://sourceforge.net/u/morphlin/profile/) for the original plugin.
15 changes: 0 additions & 15 deletions docs/Release.md

This file was deleted.

6 changes: 6 additions & 0 deletions docs/history.md
@@ -0,0 +1,6 @@
## Why was this fork created
Various reasons, first and most important: I don't want to use another application only for steam! KeePass and Tray TOTP (with some modifications) are more than capable enough to handle this task.

Second: for education, working with another developer's code, specially in a language you're not familiar with, its a difficult task but not uncommon situation.

Third: I wanted only to make a slightly modification, then I needed to make a new setting options, change the way plugin generate in order to add another step, some rewriting later, too much was changed for simply patch, so I decided to create my own fork and made more changes.
12 changes: 12 additions & 0 deletions docs/release.md
@@ -0,0 +1,12 @@
# Release

This document describes how to create a new release for KeeTrayTotp.

1. Create a new branch from the latest version of master
2. Bump the `AssemblyVersion` and `AssemblyFileVersion` in `KeeTrayTOTP\Properties\AssemblyInfo.cs`
3. Bump the version in `version_manifest.txt`.
4. Commit these two files, tag the commit as `vMajor.Minor.Build` (e.g. `v1.0.0`), and push the commit with tags.
5. A github action ` KeeTrayTOTP Tagged Release` will trigger based on the version tag.
* [ ] Check that the action succeeds.
* [ ] Check that a release with the new version is created
6. Create a PR for the commit created and merge it to master, so the version manifest becomes visible to the Keepass Update Checker.
9 changes: 9 additions & 0 deletions docs/secret_ios_backup/index.md
@@ -0,0 +1,9 @@
# Obtaining TOTP secret from an iOS backup

If you use an iOS device you can use a tool like the [iPhone Backup Viewer](http://www.imactools.com/iphonebackupviewer/) to extract the secret key.

1. Open the backup using such a tool
2. Find the Steam App: `com.valvesoftware.Steam` in `AppDomain`
3. Extract `Documents/Steamguard-[your Steam ID]`
4. Open the file using a text editor and look for the text `otpauth:\/\/totp\/Steam:[your Steam login]?secret=[TOTP secret]&issuer=Steam`.
5. Copy the value of `[TOTP secret]` info the *TOTP Seed* field of the *TOTP Setup Wizard*.
8 changes: 8 additions & 0 deletions docs/secret_rooted_phone/index.md
@@ -0,0 +1,8 @@
# Obtaining TOTP secret from a rooted Android phone

You need a rooted Android phone with a file manager application and [Steam](https://play.google.com/store/apps/details?id=com.valvesoftware.android.steam.community) installed.
Follow [this instruction](https://support.steampowered.com/kb_article.php?ref=4440-RTUI-9218) to set up Steam Guard if you did not do this before.

Then open the file manager and navigate to the `/data/data/com.valvesoftware.android.steam.community/files/` directory (requires root access). You will find a file named `Steamguard-[your Steam ID]` there, open it as a text file.
Inside the file look for the following text: `otpauth:\/\/totp\/Steam:[your Steam login]?secret=[TOTP secret]&issuer=Steam`.
Copy the value of `[TOTP secret]` info the *TOTP Seed* field of the *TOTP Setup Wizard*.
2 changes: 1 addition & 1 deletion docs/secret_sda/steam_desktop_authenticator_sda.md
Expand Up @@ -10,7 +10,7 @@ In the first step download the [program files](https://github.com/Jessecar96/Ste

Start the `Steam Desktop Authenticator.exe` executable, and follow the instructions of SDA to setup it as an authenticator for your Steam account, but when asking for an encryption passkey choose *Cancel*. We need the file unencrypted to extract the secret later:

![step4-encrypt-decition](images/step4-encrypt-decition.png)
![step4-encrypt-decision](images/step4-encrypt-decision.png)

After that there is an additional confirmation step, which explains that this is a really bad idea. However, we will move the secret to our encrypted KeePass Database, so in this special case this is OK.

Expand Down

0 comments on commit 8626a1d

Please sign in to comment.