search

daegalus / dart-otp

RFC6238 Time-Based One-Time Password / Google Authenticator Library
MIT License
100 stars 25 forks source link

Problem with dart_otp's capability of generating codes for discord, instagram, autodesk... etc #36

Closed SkyDev125 closed 2 years ago

SkyDev125 commented 2 years ago

Seems to not work with many websites.... authy and the website listed bellow are able to give the right codes, my app never was able to no matter what I tried (changing letters to caps lock, using padding, etc etc"

I have been trying to understand more of TOTP codes for the last month and a half and try to solve a big issue i've been having.

I have my app which is supposed to work like the "authy" authentication app. giving you the totp codes for the application you have registered into.

However.... for some reason it seems to refuse to work with certain types of codes, let me explain.

when I try this website: https://rootprojects.org/authenticator/

which I found in the google authenticator github (deemed pretty helpful to enable me to understand totp codes better)

however. after trying every single algorithm it offers me, and even trying to convert between different bases, I could never understand why the codes generated by that "authenticator" website work, but other websites like discord and such dont.

example of a code from that website: "FDPP6JSAGB23SSLHIK4F7JCSI5TQLS3W"

while a code from discord for example, refuses to work: "A2YFU5QBOLOWZAXP"

I havent been able to wrap my head over this for the last month... all my research has been unable to figure out why.

I only have one more month to finish the app and all the other things I have to do for my whole project... and Im really getting stressed out over this.... i cant understand whats going on.

app's github to generate the codes: https://github.com/skygamer125/PAP_Unnamed_Keyboard_PhoneApp/blob/main/lib/screens/2fa_setup/components/screens/done/components/main_body.dart

SkyDev125 commented 2 years ago

Issue discovered with the help of some people in the flutter channel

the defaults that are being used commonly across the web for totp codes use these defaults

IsGoogle = true algorithm = SHA1

this would make things more straightforward for a simple person trying to create an app for totp codes, as it should most likely work out of the box with most websites, in oposition to what took me a full month to discover how to solve

daegalus commented 2 years ago

Sorry that you had these issues, but unfortunately the Google way of padding is not RFC standard, so I can't make it the default when I am trying to be RFC compliant by default.

As for SHA1, It was originally the default, but I had a lot of complaints that sites were using SHA256, so I made that the default. I can only do so much when every website uses a variation.

I will consider changing defaults if necessary but I tried my best to document this information.

SkyDev125 commented 2 years ago

yeah, thank you. I just had a hard time discovering what it meant, and why some websites worked, others didnt.. it was a weird time.. anyway thx!