search

helloworld1 / FreeOTPPlus

Enhanced fork of FreeOTP-Android providing a feature-rich 2FA authenticator
Apache License 2.0
657 stars 75 forks source link

FR: encrypt token secret using user provided password #128

Open romeokienzler opened 3 years ago

romeokienzler commented 3 years ago

Encrypt export using e.g. OpenPGP or OpenSSL library. Otherwise the file can be read and stolen as residing on the file system.

Workaround: I encrypt the file after export using Openkeychain and then upload it to a cloud provider for backup. But while the file resides on the FS unencrypted it can be read by other apps.

Minoru commented 3 years ago

Isn't this a duplicate of #122, @romeokienzler?

OmlineEditor commented 3 years ago

encrypting files for export is important and necessary.

helloworld1 commented 3 years ago

Agreed. I plan to use a symmetric encryption with user password to encrypt all the app data and exports. The main issue is the backward compatibility. I need to make sure to also support unencrypted data if user choose to, and also during app upgrade.

OmlineEditor commented 3 years ago

do encryption even if the phone does not have a screen lock at all and you only need to turn it on to access the phone. please take this into account when designing

helloworld1 commented 3 years ago

I hope the encryption will be completely independently from system lock /account meaning you can have encryption and password without a screen lock. The biometrics can be used to login faster.

romeokienzler commented 3 years ago

@helloworld1 sorry for the duplicate and the late reply - did you have a chance to look into the issue? just created a backup and encrypted with "openkeychain" - little concerned that the json is lying around unencrypted for 30-60 seconds :)

helloworld1 commented 3 years ago

@romeokienzler Encryption is considered. There are some major change in the codebase to make the storage more flexible. The new encryptionType field in db will be used to indicate if the data is encrypted or not https://github.com/helloworld1/FreeOTPPlus/blob/master/token-data/src/main/java/org/fedorahosted/freeotp/data/OtpToken.kt#L19

And yes, enternal tool like openkeychain is good to use before the encryption is fully implemented in FreeOTP+

PhilKes commented 2 years ago

Any news on this issue? If not I would try to implement a proposition for symmetric encryption with a user password

helloworld1 commented 2 years ago

It's not being implemented now. Feel free to contribute. The room database has a field indicating the row is encrypted or not. Currently all are plain text though.

The integration of fingerprint authentication is the challenging part. Probably we can do in a separate PR.