search

PHPGangsta / GoogleAuthenticator

PHP class to generate and verify Google Authenticator 2-factor authentication
http://phpgangsta.de/4376
BSD 2-Clause "Simplified" License
2.23k stars 689 forks source link

Information Security violation by using google charts #72

Open friedrichroell opened 4 years ago

friedrichroell commented 4 years ago

As mentioned by kravietz on Stackoverflow https://stackoverflow.com/a/56737468/1171107

[...] Theusage of Google Charts are absolutely terrible from information security point of view. That's essentially sharing the TOTP secret as well as your username (alice@google.com) and issuer (Example) with a third-party company with no legal obligation to keep them secret, and doing that over a GET request! Doing so you violate not only every single assumption underlying multi-factor authentication but also most likely your organisation's information security policy. It nullifies any value added by MFA since the only factor that protects you from compromising your account in case of password breach is itself breached.

FaizanF59 commented 4 years ago

It doesn't uses google charts to generate QR code. It used different API for that

biechao commented 4 years ago

It is using "https://api.qrserver.com/v1/create-qr-code" to generate the QR code for now. To avoid security violation issue, you can use javascript library "https://github.com/davidshimjs/qrcodejs" to generate QR code in client side.

Friends4U commented 3 years ago

OR: https://larsjung.de/kjua/