search

Rookiestyle / KeePassOTP

Add OTP support (two factor authentication) to KeePass
GNU General Public License v3.0
405 stars 29 forks source link

Recovery codes not saved if no TOTP/HOTP seed is set. #144

Closed nitz closed 11 months ago

nitz commented 11 months ago

Overview

KeePassOTP does not save "Recovery Codes" if no seed is set. I want to use this field for recovery codes provided by services that use them, but don't otherwise use a TOTP/HOTP. (e.g.: services that exclusively use FIDO2.) This would allow me to keep recovery codes in a consistent place even if the secret key material is kept elsewhere.

Steps to Reproduce

  1. Create a new password entry.
  2. Open the KeePassOTP setup window for the entry, navigate to the "Recovery codes" tab.
  3. Enter any text in the text box.
  4. Press "OK".

Expected Behavior

The KeePassOTP.RecoveryCodes field should be set and saved in the entry.

Actual Behavior

The KeePassOTP.RecoveryCodes field is not set at all. The entry is marked as 'modified', but history lists no material changes to the entry other than the Last Modification Time field.

Context

OS: Windows 10 Pro 22H2 v19045.3693 KeePass Version: v2.55 (64-bit) Plugin Version: v1.67

Rookiestyle commented 11 months ago

If you delete the seed / save an empty seed, this is treated as deleting the OTP settings. In this case all KPOTP.xxx fields are removed from the entry after creating a backup.

This is not a bug. It does not make sense to save otp recovery codes without otp.

If you want to use the KeePassOTP.RecoveryCode field in the entry's plugin data for something else than OTP recovery codes, you need to provide a seed as well.

Rookiestyle commented 11 months ago

You could e. g. save a seed like -

nitz commented 11 months ago

A silly and acceptable solution! I might as well go ahead and use the seed as a note that the key is hardware only! Thanks for the workaround!

Rookiestyle commented 11 months ago

Or, even easier: Just create a field with this name manually.