Reverse engineer IRS2Go secret key generating OTP?

Lucent

The IRS is now offering offline TOTP generation via their IRS2Go app which requires an IRS username (8-64 characters, no spaces or special characters other than _) and a key shown on their site, in my case, an 8-digit number. With these two items, it generates a 6-digit number every 60 seconds. I know 1Password only supports a TOTP period of 30 seconds, but it'd be useful to reverse engineer what their app is doing behind the scenes and how it's combining the username and password into one secret to generate the code so it could be done with other software. I tried colon or pipe as a delimiter with no luck. Any suggestions?

---

1Password Version: Not Provided
Extension Version: Not Provided
OS Version: Not Provided
Sync Type: Not Provided

Unknown

This content has been removed.

Lucent

Same question for the Xfinity Authenticator app.

Ben

Hi @Lucent,

Thanks for the suggestion. I'm not aware of any definite plans at this time, but I'll certainly pass the idea along to the rest of the team for further consideration.

Ben

cellsheet

I have the same question for this app. The 2fa available notification is annoying not being able to fill it in 1password and no luck getting it to work either, but did help me become aware of the option for this particular app. Thanks.

Ben

Hi @cellsheet

Until / unless another solution is implemented you can add a tag -- "2FA" -- to your login item for this site to have 1Password ignore the fact that it thinks you aren't using 2FA.

Ben

rabidpaperclip

Were you able to ever find the totp algorithm the irs uses?

Lucent

Never had any luck with IRS or Xfinity. Probably best left to someone with the skill to decompile the APK.

Ben

:+1:

Ben