search

goaaats / xl-authenticator

Android/iOS OTP authenticator app for XIVLauncher built in Flutter
GNU General Public License v3.0
38 stars 12 forks source link

Add safety mechanism to auto-close feature #24

Open aekobear opened 9 months ago

aekobear commented 9 months ago

The "auto-close app after sending code" feature can be super dangerous. Once activated, it's practically impossible to see the TOTP code before the app closes. There's no way to access app settings to turn it off once it's turned on

TOTP is necessary for accessing secure.square-enix and mog station, so if the user hasn't set up a second TOTP app with the same code, toggling this checkbox could lock them out of their account

Consider implementing a way to access the code or settings even when this option is enabled (android supports custom app menus on long hold)

Failing that, even an in-app warning that users must have a separate app installed before enabling this option would be super helpfull

tommadness commented 9 months ago

The auto-close feature should only happen after XL-Auth successfully sends the code (read: accepted by XIVLauncher, logging you into the game). If that is not the case, that is a different issue.