search

jleclanche / python-bna

Python implementation of the mobile Blizzard Authenticator (TOTP)
https://eu.battle.net/support/en/article/24520
MIT License
250 stars 38 forks source link

Invalid TOTP URL for QR code #25

Open reepy opened 4 years ago

reepy commented 4 years ago

I was trying to get bna to generate a URL, to create a QR code so I could add it to AndOTP.

However, the QR code wouldn't scan. AndOTP ('Invalid QR code'), Authy ('Invalid format, token format not supported') or FreeOTP ('The token specified was invalid') could use the QR code because of a missing colon. Google Authenticator scans it without issue.

The spec doesn't specify the colon is required.

As soon as the colon is added it works. The colon is present in the example in README.md under 'Getting an OTPAuth URL'.

Steps to reproduce:

  1. Setup bna
  2. Run bna show-url
  3. You'll notice the code is missing the colon before the question mark. This means you can't import this URL into common TOTP apps.

For example: otpauth://totp/Blizzard:SERIAL?secret=SERCRET&issuer=Blizzard&digits=8 Should be: otpauth://totp/Blizzard:SERIAL:?secret=SERCRET&issuer=Blizzard&digits=8

You can verify this:

  1. Install a QR code generator pip3 install qrcode[pil]
  2. Run qr "PASTEURLHERE"
  3. Try and scan the QR code. You'll notice you get an error.
  4. Repeat step 2, but add the missing colon.
  5. Try and scan the QR code. You'll notice it works this time.
DLslime commented 4 years ago

No, it doesn't work. AndOTP still can't scan that QR code until you delete &digits=8 manually.

mprobson commented 4 years ago

Deleting the &digits=8 let me scan the code but then I was unable to use it (or modify it to generate more digits)

DLslime commented 4 years ago

AndOTP don't allow you to modify OTP's digits after you add it by scan the QR code. So anyway, it is definitely AndOTP's own defect. Other authentication Apps should be tested to see whether they also have the similar problem.

reepy commented 4 years ago

I tried other TOTP apps and it's in the original report (without removing &digits=8):

I've just tried a few more:

So maybe the standard is unclear and some are OK with the colon and others aren't?