Andotp: Feature request: Steam mobile authenticator codes

[Roliga]

Hi,

The Steam Mobile Authenticator uses standard TOTP passwords, but differs in that it generates a 5 character string. Is this something that could be implemented in andOTP?

For reference WinAuth has this implemented here, see this for a short write up about it. The KeeTrayTOTP plugin for KeePass2 has a somewhat more concise implementation here.

Would be convenient with one less authenticator app on ones phone :)

[flocke]

The 5 digits are not the real problem. This is just one line of code to change.
But they also use letters in their code, so it's not a 'real' TOTP. I will have to look into how it is generated and decide then if I want to implement it.
Since I'm currently on vacation this will take some time.

[Roliga]

Sounds good, thanks for your work on this app and have a great vacation!

[flocke]

After looking at the code for the KeeTrayTOTP plugin this seems very doable.
I will try to get this in for the next release.

[flocke]

I have an implementation to generate SteamGuard codes, but I'm not sure if I should release it for the following two reasons:

1) You still have to get the secret somewhere and manually add it (I won't implement an automatic method where you just have to enter your steam account since this is far beyond the scope of this app).
2) And after you activate it somehow you won't be able to trade in Steam anymore, since that requires confirmations that are handled by the Steam app.

[Roliga]

While I personally still would find this a very useful feature, the reasons you mentioned definitely means it's not for everyone. The use cases I see are:

• Using F-Droid as a primary app repository, where keeping the Steam app installed can be inconvenient.
• Having all 2FA codes in one place, making them easier to manage and securely back up.
• Having Steams authentication codes available on multiple devices. In this case, depending on how you acquire the secret, you could still use the normal Steam app as usual for trading.

While I don't use Steams trading functionality myself, and I'm sure I'm not the only one who doesn't, I imagine a lot of people indeed do. And as you say having to get the secret somehow manually isn't ideal either.

Either way I really appreciate your work on this app and the time you've spent on this feature!

[flocke]

This won't make it into the next release, I have to think about it a little bit more.
Maybe I will add it in the one after as a hidden option for people who know what they are doing.

[flocke]

I added this as an hidden option.
To enable it go to About and tap the version tile 7 times (stolen from dev options in Android).
There will be a warning that this is not further supported and you have to get the shared secret on your own.

Disclaimer: Steam trading won't work with this enabled since you won't be able to confirm trades.
This will never be implemented, so please nobody ask for it, this is far beyond the scope of this app!

[flocke]

I will publish the next release in a week, giving the translators time to catch up.
I wrote a little page about the hidden feature in the wiki: https://github.com/flocke/andOTP/wiki/Special-features
There you can also see how you can get your shared secret.

[Roliga]

Thanks for implementing this, much appreciated!

[theo546]

Hi, i give a feedback if needed, it work perfectly fine!!
for anybody that are on linux and want to convert the base64 code to base32, use this easy command (dont remove the quote!!):

echo "< code goes here >" | base64 -d | base32

[flocke]

@theo546 Thanks for the feedback and the command, I added it to the wiki page.

[mig4ng]

I activated the special features but where do I insert the secret to generate steam codes aswell?

[Roliga]

@mig4ng In andOTP press the + icon, then press enter details. Set Type to STEAM, set Label to whatever you want and put the secret you got in the Secret field.

I think the wiki mentions this here, but maybe it's not super clear (:

[mig4ng]

Thanks! Hope it helps others find it as well :)

On Wed, 8 Aug 2018, 23:36 Roliga, [e-mail] wrote:

@mig4ng https://github.com/mig4ng In andOTP press the + icon, then
press enter details. Set Type to STEAM, set Label to whatever you
want and put the secret you got in the Secret field.

I think the wiki mentions this here
https://github.com/andOTP/andOTP/wiki/Special-features, but maybe it's
not super clear (:

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/andOTP/andOTP/issues/38#issuecomment-411575559, or mute
the thread
https://github.com/notifications/unsubscribe-auth/AFjCz-J3K9JbwTZzNm5IlYO2GdeV_BKIks5uO2f3gaJpZM4PLHBt
.

[Kreyren]

ping @flocke: i have problems with Steam Authentificator on https://github.com/Winetricks/winetricks/pull/1371/files/eeb887a97ac0ee17eae5c2bef41185a93ffd2d3f

Did you find a way to get the hash so that the authentificator could be set up locally?

[theAkito]

This is absolutely amazing! Thank you for making my phone free of this Steam Guard bloatware. Thank you so much!