Add warning about apps that don't support alternative hashing algorithms

samdjstevens / java-totp

A java library for implementing Time-based One Time Passwords for Multi-Factor Authentication.

MIT License

422 stars 103 forks source link

Add warning about apps that don't support alternative hashing algorithms #30

Open samdjstevens opened 4 years ago

samdjstevens commented 4 years ago

Add some warnings in the README about using SHA256 and SHA512, with a list of known apps that do and don't support them.

connickshields commented 3 years ago

I just wanted to give you a heads up that after testing, Google Authenticator on Android doesn't support SHA256 or SHA512. I also believe that Duo Security on iOS doesn't support SHA256 or SHA512, but I am not 100% sure on that.

mendess commented 2 years ago

It seems Authy and 2FAS Authenticator also don't support SHA256 and SHA512

Stexxen commented 2 years ago

Copied across from - https://github.com/samdjstevens/java-totp/issues/27#issuecomment-591537004

Apps that work with SHA-256 and SHA-512 Android

Oracle Mobile Authenticator
Auth0 Guardian
Sophos Authenticator
FreeOTP Authenticator

iOS

Oracle Mobile Authenticator
IBM Verify
Sophos Authenticator
FreeOTP Authenticator

And apps that appear to not support SHA-256

Google Authenticator
Microsoft Authenticator
LastPass Authenticator
Duo Mobile
Authy
2FAS Auth

mendess commented 2 years ago

I'd like to add that Aegis on Android, also works with SHA256 and SHA512.

damarur commented 9 months ago

Hey, I tried to use this library but no success. I ended up using Keycloak implementations, adapting it a little bit. Just in case this helps somebody, the URL that made it work with Google Authenticator and Microsoft Authenticator is something like this (used for creating the QR code): otpauth://<type>/<issuer>:<username>?secret=<secret>&digits=6&algorithm=SHA1&issuer=<issuer>&period=30 Where type is "totp" or "hotp". (in my case "totp" because it's based on time) Issuer and username will be displayed at the app and secret is just you secret in plain text.