Github TOTP does not work. about keeweb HOT 6 CLOSED

Hi,

Not sure I completely get your issue. You mention two different URLs, one working, and one not working, but then you mention further down that neither work.

The syntax for an otpauth URL is:

otpauth://totp/LABEL?secret=SECRET&issuer=ISSUER&algorithm=SHA512&digits=6&period=NUM

If I plug my Github OTP secret into your first example, it does indeed generate an OTP code

otpauth://totp/default?secret=FX12345678912345&period=30&digits=6&algorithm=SHA1

Have yet too see any otpauth URLs formatted starting with otpauth://totp?secret

A tool I like to utilize to confirm otpauth URLs is: https://gchq.github.io/CyberChef/#recipe=Generate_TOTP('',32,6,0,30), or you can also use: https://stefansundin.github.io/2fa-qr/

If you can give me a URL from one of those two tools of an OTP url that works in the website, but not in KeeWeb, paste it here and I'll take a look. For security reasons; both those tools do have offline versions if you don't want to use the live sites.

from keeweb.

Thanks for supplying the page. Yes I am not sure if the format I got was from github itself or keepassium. I just wanted to post it since i came across it.

non working
otpauth://totp?secret=MNOTMSR4OU7U6&period=30&digits=6&algorithm=SHA1

working
otpauth://totp/default?secret=MNOTMSR4OU7U6&period=30&digits=6&algorithm=SHA1

The non working URL has been working in keepassium... just not in keeweb

from keeweb.

Ah ok. That's the first time I've seen an otpauth url like that. I even did a Google search for "otpauth://totp?secret" and it came back with exactly three search results, two of the same and one other in German, and sounded as if they were custom scripts that may have gotten it wrong or were doing something different.

The downside is that Keepassium is Apple, and I at present, don't have an iphone device to test with, which is what makes apple scenarios a pain.

I'll go do some more poking around today and see if I can find another example.

Edit: It looks like Proton is also doing something similar. Learn something new every day I guess. I'll investigate this more and let you know. It's super early morning, so I need to get my eyes open first.

I'm fairly certain it's going to require an update to the app. If my memory serves me correct, otpauth://totp/default?secret= is hardcoded in without any deviation.

from keeweb.

@BoKKeR Managed to work it out to where KeeWeb now supports both options of formatted string and returns the same OTP code.

Need to go through and test the other aspects of OTP. I'm new to the development team, so I haven't completely memorized where everything ties in; so I have to ensure I don't need to implement additional adjustments to other areas.

from keeweb.

That was very fast! Thanks for your work!

from keeweb.

No problem. Just trying to prioritize right now and get a feel for what is what so that I can start making a game-plan. Need to figure out how releases are going to go.

from keeweb.