Keepassdx: TOTP Secrets are not validated

[grimpy]

Describe the bug
When scanning the tokens given by github/google they are not in base32 format so they are rejected by keepassdx.

When attempting to open an entry with an existing token keepassdx shows Invalid OTP secret

KeePass DX (please complete the following information):

• Version: [e.g. 2.5.0.0beta24]
• Build: from github
• Language: English

I have no idea however in which format they are currently stored in, I see all lowercase latters and some numbers. The github one is 16characters long and the one of google is 32characters long.

FYI: The way they are currently stored work fine for both keepass2android and keepassxc

Any help would be appreciated

[J-Jamet]

The keys in base 32 must contain only capital letters from A to Z and numbers from 2 to 7.
https://tools.ietf.org/html/rfc4648
https://github.com/google/google-authenticator/wiki/Key-Uri-Format

For the case of github, simply replace the letters by uppercases.
This is an error in github URL, I will add a method in the next update to automatically uppercase the letters.

[grimpy]

Thx for the quick reply, yes this indeed fixed it for both github and google

[Komic]

It would seem KPDX also chokes on Amazon's 52 characters long secrets, running the 2.5.0.0beta24 build from this repo.
Also seeing issues for humblebundle.com (26 chars). Both are valid, uppercase Base32.

[J-Jamet]

Thank you for your feedback @Komic.
This keys are not in Base32 format.
To be valid, it is necessary to add 'A' ( 6 for humble bundle-> AAAAAA, 4 -> AAAA for Amazon) at the end of the key.
I will change the code to be more lax.

[grimpy]

@J-Jamet while you are changing the code, google also in certain cases (when requesting to copy the key manually) adds spaces inside the keys, maybe you want to handle this aswell?

[J-Jamet]

@grimpy Yes of course, I'm adding that for the copy.

[Komic]

(6 for humble bundle-> AAAAAA, 4 -> AAAA for Amazon).
I will change the code to be more lax.

sounds great, thanks!
I meant to ask, too: is there support for those parameters (6/8 digits mostly)?

[J-Jamet]

6/8 digits works. The update is available.