search

nextcloud / twofactor_totp

🔑 Second factor TOTP (RFC 6238) provider for Nextcloud
https://apps.nextcloud.com/apps/twofactor_totp
GNU Affero General Public License v3.0
282 stars 56 forks source link

Displays in Google Authenticator #135

Open copenhaus opened 7 years ago

copenhaus commented 7 years ago

Hi.

When I snap the barcode with my Google Authenticator, on the bottom it displays the Federated Cloud ID.

If I were to setup/enable 2FA settings on multiple accounts on my Google Authenticator, I can't tell the differences...

Can the display of Federated Cloud ID be changed to username?

Thanks....

ChristophWurst commented 7 years ago

What does your federated cloud ID look like? I chose to use it because it's pretty unique, also if you're using many NC accounts.

copenhaus commented 7 years ago

12345678-1234-4321-9257-FDFA5F682041@cloud.company.com...to me, it's like going to a website using its IP address (http://88.198.160.129), instead of FQDN (http://www.nextcloud.com)...IMHO...

ChristophWurst commented 7 years ago

Ouch. I guess that's not the login name you're using to log on, is it? Does your instance use LDAP as user backend? I wonder where that long username comes frome …

copenhaus commented 7 years ago

yes, my NC is integrated with Windows AD through LDAP.

ChristophWurst commented 7 years ago

@blizzz any idea whether the federated cloud id should look like this when using an LDAP back end or this is caused by misconfiguration?

mddeff commented 7 years ago

@copenhaus As a work around, you could switch to FreeOTP (rather than Google Auth) for your TOTP client; it allows you to rename the metadata fields on each OTP entry. Also, FreeOTP is FOSS (written by RedHat/Fedora), where as I believe Google Auth is closed source (or what they have open-sourced is out of date), and is available on iOS and Android (one less userguide to write for your users ;-) ).

Not a permanent solution, but at least it helps. I'd be interested to see the resolution, I'm seeing the same behavior,

blizzz commented 7 years ago

@blizzz any idea whether the federated cloud id should look like this when using an LDAP back end or this is caused by misconfiguration?

@ChristophWurst federated cloud it is always username@server and by default usernames are created of the UUID of the LDAP record, so, yes, this looks correct.

However, I believe we have a dirty hack in place that allows you to use your loginname instead, and it will be transformed by the server… but this is very dirty, very ugly 🙊

ChristophWurst commented 7 years ago

Labeling as enhancement because this only effects the name of the secret in your smartphone's app. The TOTP functionality should not be effected.

nursoda commented 7 years ago

When you're serious about 2FA/TOTP, use Mufri's "Authenticator Plus" (paid) app. You may change icons, label, overall look, add another security layer accessing TOTP (e.g. using Fingerprint), etc. and it can BACKUP all your secrets (complete config), so that you may reinstall on another phone. (Well, backup is important if you do NOT use a rooted phone.