search

PHPGangsta / GoogleAuthenticator

PHP class to generate and verify Google Authenticator 2-factor authentication
http://phpgangsta.de/4376
BSD 2-Clause "Simplified" License
2.26k stars 698 forks source link

Possible security problem #3

Closed NoodlesNZ closed 8 years ago

NoodlesNZ commented 11 years ago

While it's easier to use Google's chart service to render the QR code, it's easy to capture this URL and replay it (I think you mentioned in the Read Me). Is there not a more secure way to handle the QR code without firing off to Google?

PHPGangsta commented 11 years ago

Hi,

of cause it is possible to use your own QR code library for that. Just google for "php qr code" or something similar and you will find many PHP libraries to generate QR code images on your own server. It will take a few more lines of code and adds a dependency to another library, but it's possible of cause.

wozzup commented 10 years ago

you can use curl, or just no QR char

josecelano commented 10 years ago

You can use http://larsjung.de/qrcode/. This way the QRCode is generated in client side with Javascript, and the browser can not cache the image.