search

IJHack / QtPass

QtPass is a multi-platform GUI for pass, the standard unix password manager.
https://qtpass.org/
GNU General Public License v3.0
1.03k stars 162 forks source link

OTP unexpected behaviour #517

Open thomo5000 opened 4 years ago

thomo5000 commented 4 years ago

Debian testing packages: qtpass 1.3.2-1 pass-extension-otp 1.2.0-1

Behavior: When clicking the OTP button it copies the setup URI to clipboard.

Expected behavior: When clicking the OTP button it generates a one-time code and copies that to clipboard.

Note: Only reproducible when using "Native Git/GPG". "Use pass" works correctly.

annejan commented 4 years ago

It is a backup of the URI so you can import it into any OTP generator.

This is something we should probably fix in the documentation, or just copy-paste an OTP generator example . .

thomo5000 commented 4 years ago

Do you mind having another look? In https://github.com/IJHack/QtPass/issues/327#issuecomment-339932460 it seems the intended (or at least requested) behavior was to generate a OTP, and qtpass does generate a OTP when configured to "use pass". The committed code even contains PASS_OTP_GENERATE.

The functionality I'd like to see is that the OTP button behaves the same way when "Native git/gpg" is configured as it does when "Use pass" is configured. If this is not already the intended behavour then can this be a feature request?

Noettore commented 4 years ago

Currently qtpass uses the pass extension pass-otp to generate the one-time code. To make it work without pass it's necessary to implement the code generation inside the qtpass codebase or to add the possibility to use an external tool like oathtool which is the one that pass-otp uses.