§1The problem
A service asks for just a few characters of a fixed code, and I don't want to keep the whole code in plain text or show it in full on screen.
§2What I built
- Native windowGTK, with no server: I type the positions and see only those characters.
- UnlockWith a YubiKey touch; closes with Esc and by itself after 2 minutes idle.
- Write scriptTerminal only, to set or change the code (asks twice, never shows it).
§3The hard parts
5 entries- 01
File encryption
AES-256-GCM with a key derived (HKDF) from the YubiKey's response to a fresh challenge on every write.
- 02
Read-only app
Files written without the key are refused.
- 03
Memory hygiene
The code leaves memory after inactivity.
- 04
Testing with a software YubiKey
Only valid with a test file, never with the real one.
- 05
GTK UI tested
On a virtual display with automation.
§4Result
In use, with a shortcut on the system panel.
§5Stack
- Python 3
- GTK 3 (PyGObject)
- AES-256-GCM
- HKDF
- YubiKey (ykman, challenge-response)