search

freeotp / freeotp-android

Apache License 2.0
1.37k stars 290 forks source link

[Feature-Request] Allow adding of entries by just specifying label & secret #360

Open ChrLau opened 9 months ago

ChrLau commented 9 months ago

Hi,

I set up 2FA on my LinkedIn account today and ran into some problem with FreeOTP. Root cause is that LinkedIn doesn't display a QR-Code anymore (got removed when they where bought by Microsoft it seems). They just display the secret key and tell you to enter that into the Microsoft Authenticator App.

Google Authenticator seems to have such a feature too.

But FreeOTP lacks this. And as LinkedIn was providing no technical information about the algorithm and the like I wasn't able to make it work initially. LinkedIn reported that the entered code wasn't valid.

What worked however was to build the most basic otpauth:// string myself and generate a QR-Code from that. otpauth://totp/LinkedIn:MyAccount?secret=BCUTUKT6MT33Y3FCHSMHU2XRHKLTX7RN

After scanning this QR-Code with FreeOTP the code was accepted by LinkedIn.

Is it possible to add such a feature to FreeOTP? Some dialogue where I can only choose if it's TOTP or HOTP, specify the label, the secret and that's it? Omit all other parameters. If you need that, you can still use the already existing dialogue.

Would save me a few minutes even with termux and qrencode installed on my Android phone. ;-)

justin-stephenson commented 9 months ago

FreeOTP includes this 'Manual add' feature already. When you press the + Icon to add a token, press the pencil button instead of the QR code button. Can you please check if this works for you?

ChrLau commented 9 months ago

Hi, I tried using that feature. But I think the problem is that there are always the parameters for algorithm and interval included. And there is no way to make them optional/omit them.

justin-stephenson commented 9 months ago

If algorithm and period are not provided as part of the otpauth URI, then FreeOTP assumes SHA1 and 30, does the code fail when these values are selected ?

ChrLau commented 9 months ago

Deactivated 2FA on LinkedIn and set it up again. Choosing SHA1 and interval auf 30 works. I assumed SHA256 is the default is this is always pre-selected.

justin-stephenson commented 9 months ago

Are you okay to close this ticket or do you see some improvement needed still in FreeOTP?

ChrLau commented 9 months ago

In general it's ok for me to close this issue.

On the other hand I feel like there is room to improve the manual add feature for the user. As algorithm and interval are, to my understanding, optional parameters. Therefore one could argue that there should be no pre-selected value in the manual add dialog. But I don't know how much of a problem this is, to justify the efforts in coding, etc. After all many sites just offer a QR-Code and be done with and don't prefer to do, what LinkedIn does, just to promote the usage of the Microsoft Authenticator..

justin-stephenson commented 9 months ago

I agree. We should improve the manual token UI similar to https://stefansundin.github.io/2fa-qr/ which allows removing and adding the optional otpauth parameters such as algorithm, digits, and period.

ChrLau commented 8 months ago

That would be the best way IMHO.

rockdaboot commented 3 months ago

I ran into the issue today and it still is quite a nuisance. Setting up LinkedIn 2FA failed for me on the first try. Thanks to the well written instructions from @ChrLau my second try succeeded.

ChrLau commented 3 months ago

I ran into the issue today and it still is quite a nuisance. Setting up LinkedIn 2FA failed for me on the first try. Thanks to the well written instructions from @ChrLau my second try succeeded.

Thanks for the flowers. 😄 Reminded me to add a TL;DR to my post. As the whole "generate a QR code" part can be omitted if you figured out the parameters LinkedIn requires.