Encrypted(?) Storage about freeotpplus HOT 12 CLOSED

The tokens are not encrypted and I think that it is possible to have them backup up (either through adb backup or through GDrive).

allowBackup is true, which means that external backups and Google backups are allowed:

The normal SharedPreferences storage is used with MODE_PRIVATE. This just means that other apps cannot access it, but it is not encrypted in any way:

To actually employ encryption, the KeyStore API should be used:
https://developer.android.com/reference/java/security/KeyStore

from freeotpplus.

Yes, encryption support is still on my todo list. I don't think FreeOTP+ can actually use KeyStoreAPI because the data needs to be stored elsewhere and restored on a different device.
I am thinking about using simpler (weaker) symmetric crypto to just encrypt secret part of the data.
Also I would like to have PIN / fingerprint support which requires quite some more work. If you are aware of any libraries to help the UI of PIN / fingerprint, it would be a great help here.

from freeotpplus.

encryption support is still on my todo list.

How about lifting from another project?

https://github.com/andOTP/andOTP

from freeotpplus.

To actually employ encryption, the KeyStore API should be used:

Seems to be a good idea. Does this mean that the original FreeOTP stores the keys unencrypted as well?

from freeotpplus.

Does this mean that the original FreeOTP stores the keys unencrypted as well?

That is correct, the original FreeOTP implementation also lacks encryption. Their developers are open to implementing it though, indeed using the KeyStore API: freeotp/freeotp-android#6 (comment)

There is one PR to implement this, I have not reviewed though and mention it since it was referenced from the previous issue: freeotp/freeotp-android#150

from freeotpplus.

Facing same issue. Everytime I take backup, the .json file remains on phone storage in plaintext. It's obvious to keep it on same location and forget about it. Also, keeping a backup in plaintext is not recommended.

@helloworld1 Kindly implement.

from freeotpplus.

I don't do ('dont know', precisely) any coding part. But, while lurking on internet, I came to know about some of the open source encryption libraries which can be implemented in android applications very efficiently.

https://facebook.github.io/conceal/
https://github.com/google/tink
https://github.com/google/capillary
https://github.com/simbiose/Encryption

Hope, this helps.

from freeotpplus.

I don't do ('dont know', precisely) any coding part. But, while lurking on internet, I came to know about some of the open source encryption libraries which can be implemented in android applications very efficiently.

I understood the comment was asking about libraries for the user interface part for PIN or libraries for fingerprint, not for encryption.

from freeotpplus.

encrypting tokens using any of the suggested library with user PIN/fingerprint hash will be sufficient.

from freeotpplus.

@unicorntaco I found the implementation of andOTP pretty good and convincing. I wonder what is the advantage of FreeOTP / FreeOTP+. Also FreeOTP+ provides the capability to migrate to andOTP.

from freeotpplus.

One big advantage of the original FreeOTP is that it uses a decent layout on tablets... see #121

from freeotpplus.

Let's consolidate the discussion in #128

from freeotpplus.