Symantec VIP Access Token support

Symantec has created their own TOTP that should be possible to convert to generic TOTP, but these instructions are not something an average user can be expected to follow. It would be great if Bitwarden could have some specifier such as SYMC:// that would do the needed when adding these time-based one time passwords.

Arguably Symantec VIP is not very widely used, but there are enough web sites using this technology that I think it would make sense to add this feature. Point of the feature is provide the usual Bitwarden benefits to these SYMC TOTPs - one does not want to manage separate authentication applications on phone, or have complicated backup credentials in case of losing a phone.

1 Like

Bump.

I would love to see BitVault accommodate the Symantec VIP 2FA. I have lots of 2FA already in BV. I only have 1 VIP 2FA. What an annoyance. I love my BV and would love to see the code (looks like it’s open source and in this thread) added to BV.

Symantec VIP is not open source, but was reverse-engineered (at least in part) by @cyrozap in 2014, and this lead to development of some open-source Python utilities that were linked by @kerolasa above. As noted by the developer of the python-vipaccess tool, the code relies on spoofing the “App Handle” of an old macOS version of the Symatec VIP software, an app version which is no longer supported by Symantec. For this reason, the reverse-engineered utilities can be prevented from working if Symantec’s servers refuse to communicate with the expired app; Symantec apparently did brick the reverse-engineered apps for a brief period in May 2020, and could do so again at any time in the future.

Due to the lack of robustness of the existing work-arounds, coupled with the questionable legalities of reverse-engineering Symantec’s VIP app, I am doubtful that this will be implemented in Bitwarden.

Thank you for this excellent answer.

1 Like