Open vertigo220 opened 4 years ago
When you scan a QR code, Aegis reads its contents and fills the OTP type, hashing algorithm, digits and secret fields for you automatically. You're not supposed to change them. Changing them would result in incorrect one-time passwords.
The "Issuer" field is set to the name of the service the OTP is for and the "Name" field is usually set to the username/email address used to log into that service. They're not required to be in any particular format.
I think most of the confusion can be eliminated by hiding the advanced fields by default for new entries, unless the user chose "Enter manually". What do you think?
I was actually using the manual entry option, which is why I was confused about the fields. Are you saying they show even when scanning a barcode? I've just become accustomed to manually entering the long string provided when setting up 2FA vs scanning barcodes because the scanner in Authy hasn't worked for me for a long time. But then the other day I read an article about how the barcodes contain a lot of superfluous info that could make it easier for someone to access the protected accounts if they were to gain access to the 2FA app, and therefore it recommended against using them and instead to do it manually. For example, scanning a barcode for email, it might actually include the email address, so if the 2FA app were compromised, an attacker would have not only the code, but the account it goes to. Based on what you said, this would be the "Name" field.
The problem I'm having is that with Authy, even doing manual entry all you need to do is enter the code provided and you're done. With Aegis, it presents you with all these other fields, which is not only confusing but I worry it presents the possibility to set it up improperly, which would cause the user to lock themselves out due to not being able to generate a code that the server expects. And it seems you're confirming that is possible, so hopefully I didn't lock myself out of the one I set up the other day (I chose one that if that did happen, it wouldn't be hugely disastrous, but it would still be inconvenient).
This is as much a help request as it is a feature request. Maybe it's just me, but coming from Authy, where you just scan a barcode (something I just learned isn't recommended) or manually enter the string provided by the service the 2FA is being set up for and then you're done, I'm having a tough time figuring out how to use this. In contrast to the very simple setup of Authy, Aegis requires much more info to be entered and choices to be made, and I have no idea what to put and choose. It would be ideal to have a guide, both in the app and here, on the different fields and what they mean and which options are generally preferred.
*I don't have an in-depth understanding of how OTP codes are generated and work, obviously, and I always thought that each service has its own, specific way of doing it. So for example, I assumed that if you set up 2FA on Google/Facebook/whatever, the barcode or key would determine how it's calculated, so the generator and the website would always match. Based on that logic, if you change the hash, digit length, or timeout, they wouldn't match. I hesitated for a bit to set up a 2FA because of this, but having been a while since I've set one up, in doing so now I see it has you enter the code from the generator to complete setup, so I'm guessing it determines what various settings you used based on that?