search

Bubka / 2FAuth

A Web app to manage your Two-Factor Authentication (2FA) accounts and generate their security codes
https://docs.2fauth.app/
GNU Affero General Public License v3.0
2.06k stars 139 forks source link

Encrypt Service Name !!! #365

Open 5andr0 opened 2 months ago

5andr0 commented 2 months ago

Why was service name not considered sensible when you added encryption? I'm not allowed to leak any of my sensible 2FA services, so I had to double check the code if my data is really 100% encrypted, but service name was NOT ENCRYPTED! It would be nice if I didn't have to add extra encryption to the database file manually before syncing it to the backup cloud.

I will leave a donation when this gets implemented!

Bubka commented 2 months ago

The decision was made to allow server-side filtering/searching on services. I understand it can be considered as sensitive as the secret or the email data though.

The unexpected part is that finally no server side filtering is implemented 😅.

I don't want to restrict the api capabilities completely, so I suggest to handle it via an admin option. Something like a yes/no checkbox called "Encrypt service names" and a legend explaining why and how it affects the behavior of the api. It could be set to On by default.

5andr0 commented 2 months ago

I feel you man, it's hard to maintain an open source project for free. There's so many nice ideas, but not enough time 😅 I'll support you a bit with a donation, since this is the only option for a self hosted totp service with a nice UI. So thanks for making it public!

Just query all the users entries and decrypt them on the fly for filtering in php. There shouldn't be much of a performance impact compared to sql query filtering. Might be even faster if you cache the decrypted data

Bubka commented 2 months ago

Many thanks for your feedback and your sponsor. I hope to have some time in August to work on this, it will be at the top of the list.