Andotp: HOTP Support

Created on 25 Jul 2017 · 13Comments · Source: andOTP/andOTP

Support HOTP tokens in addition to TOTP

enhancement

Source

flocke

👍4

Most helpful comment

@sjug Yes, I was thinking about maybe dropping the hidden option for HOTP type tokens and always show something like "Tap to generate token" which has to be pressed to create a new token.

flocke on 18 Apr 2018

👍2

All 13 comments

I'd suggest to remove the option for adding a HOTP for the time being then.

ghost on 27 Jul 2017

@Datenschutz Done, I removed the HOTP option for now (was still there from some internal testing).

flocke on 27 Jul 2017

This may be useful, https://github.com/winauth/winauth/blob/master/Authenticator/HOTPAuthenticator.cs

RichyHBM on 27 Nov 2017

I'm gonna release 0.4.1 and make it stable on Google Play (if no critical issues get reported here). After that the next big step is gonna be HOTP.

flocke on 19 Feb 2018

🎉2

Closed it a little prematurely. I have a working implementation for HOTP and you can already add accounts by scanning a QR code but there are still a few things to be done:

[x] Manually enter HOTP accounts
[x] Tests for the HOTP generation

flocke on 20 Mar 2018

Anyone that wants to test the HOTP support can sign up for the beta testing on the Google Play store.
I'm still trying to figure out what is the best way to distribute beta versions on F-Droid.

flocke on 17 Apr 2018

@flocke Releasing them as Pre-Release on GitHub is one way (but not directly done trough F-Droid)

maracuja-juice on 17 Apr 2018

Do we need to manually iterate the # to the left of the copy button?

sjug on 17 Apr 2018

@maracuja-juice Yes, that is on my todo list. But I'm currently not on my build machine with the correct signing keys.
@sjug Yes, for now you have to manually iterate the counter. Tapping the counter increases it by one, long pressing it opens a dialog where you can manually edit it. I will have to come up with an idea to improve the usability a bit.

flocke on 17 Apr 2018

With the hidden option enabled, it does make sense to iterate before/after reveal that way each time you show it has a new value.

sjug on 17 Apr 2018

@sjug Yes, I was thinking about maybe dropping the hidden option for HOTP type tokens and always show something like "Tap to generate token" which has to be pressed to create a new token.

flocke on 18 Apr 2018

👍2

sorry, andOTP does not seem to work for Duo Security's HOTP protocol. Tried scanning Duo's QR code or entering the secret but get error "invalid QR code" or "invalid secret" respectively, using andOTP 0.7.1.1. Am I missing something ? thanks.