search

VladimirAkopyan / Authenticator

Authenticator for Windows - UWP store app
https://vladimirakopyan.github.io/Authenticator
MIT License
56 stars 16 forks source link

[Blizzard Authenticator]Add option for variable length OTP codes #5

Open TheManii opened 4 years ago

TheManii commented 4 years ago

Issue: Blizzard accounts use the same, standard TOTP formula as most common TOTP accounts, only that it uses 8 digit OTP codes instead of the more common 6 digit codes

What I saw: (example) 123456 What I expected: (from winauth with same secret) 90123456

How to reproduce:

  1. Download Winauth
  2. Create a new blizzard authenticator
  3. Export the authenticator to a text file
  4. Import the secret into winotp
  5. Observe the last 6 digits match.

The formula is definitely the same, as watching multiple keys produces the same last 6 digits in both, only the first 2 are cut off.

VladimirAkopyan commented 4 years ago

This is interesting, I should not be too difficult.

TheManii commented 4 years ago

You can confirm the formulas in

  1. WinBMA: https://code.google.com/archive/p/winbma (MIT)
  2. WinAuth https://github.com/winauth/winauth (GPL-3)

You can also recover the secret from the serial and restore code, but that's specific to Blizzard authenticators.