helloworld1 / FreeOTPPlus

Enhanced fork of FreeOTP-Android providing a feature-rich 2FA authenticator
Apache License 2.0
653 stars 75 forks source link

[Feature request] support device-to-device transfer of tokens #272

Open paulmillar opened 4 months ago

paulmillar commented 4 months ago

I am using FreeOTP+ on my phone. It was working well, thanks!

I recently got a new phone. Naturally, I would like to use FreeOTP+ installed on the new phone. To do this, I would need a set of tokens on the new phone that correspond to the tokens on my old phone.

Some services (for which I have a token on my old phone) support multiple tokens, so I could register an additional (new) token for the new phone. Other services support only a single token and I would have to go through a recovery procedure to obtain a new token.

In either case, "moving" to the new phone requires considerable effort.

Perhaps an easier approach is to export the secrets (e.g., as a JSON file), somehow transfer this backup file from the old phone to the new phone and then import the JSON file. This is somewhat better, as it's an O(1) operation (independent of the number of tokens), but the backup is store "somewhere", transferred "somehow". So, such a process isn't simple and would likely involve the tokens being transferred unencrypted.

In my view, a better solution would involve bringing the two phones together, "introducing" them to each other (some kind of mutual authentication and establishing a shared secret), and allowing the transfer of tokens (encrypted with the shared secret) between the two devices.

Supporting this kind of token transfer would make it much easier to transfer tokens, when moving to a new phone.

Like this