HOTP secret works as TOTP setup key

revalo / duo-bypass

Stuff after reverse engineering DUO's mobile app.

97 stars 31 forks source link

HOTP secret works as TOTP setup key #12

Open Enterprise-D opened 3 weeks ago

Enterprise-D commented 3 weeks ago

Hi,

I recently found my Duo Mobile officially switched from HOTP to TOTP. I played with the code around and realized the HOTP secret can be used to set up TOTP as well. TOTP is much better supported by password managers like iCloud Keychain. README could be updated a little bit.

Thanks

alucryd commented 2 days ago

Would be nice to be able to generate a TOTP QR code instead of HOTP now that the app does support TOTP.

@Enterprise-D What modifications did you make? If I use the secret in Aegis to generate a TOTP the resulting codes aren't accepted, only HOTP codes are.