Find Substitute for Google Authenticator Class

d8-contrib-modules / tfa

DEPRECATED - D8 TFA port now on drupal.org

https://www.drupal.org/project/tfa

5 stars 11 forks source link

Find Substitute for Google Authenticator Class #35

Closed therealssj closed 8 years ago

therealssj commented 8 years ago

Motivattion

The google authenticator class saw it's last commit about a year ago and is not maintained anymore.
There are quite a few pull requests related to security mainly targetting timing attacks which we should definitely have in the class we use.

Resolution

Find a different repo which is much more updated than the current one.
Fork the Google Authenticator repo and update it as needed.

therealssj commented 8 years ago

This repo https://github.com/ChristianRiesen/otp looks good. It doesn't have recovery codes yet but I created an issue and the author replied that he can add that as a convenience function.

nerdstein commented 8 years ago

Awesome!

nerdstein commented 8 years ago

Let's give it a shot. Is it on composer/packagist?

therealssj commented 8 years ago

Yes it is. I will add it soon. It is still missing recovery codes so I am waiting on the author to add that in. I went through the code once and it is good :)

therealssj commented 8 years ago

The library now supports recovery codes and I recently made a pull request to fix another issue.

therealssj commented 8 years ago

Using https://github.com/ChristianRiesen/otp now