gaetanomatonti / uno Goto Github PK

Open-source documentation should be added to the repository, like license, contributing and package installation documentation.

Description

When using a device for multi-factor authentication through OTPs, metadata should be stored and backed up (on a cloud solution presumably) so that users won't lose access to the authentication when deleting the app or switching device.
A good approach would be to encode the metadata (updated with the correct counter for counter-based OTPs), encrypt it so that only the app is able to decrypt it (maybe with CloudKit encrypted fields) and providing it to the client for backup.

It would be useful to add otpauth URI parsing for easy initialisation of OTP Metadata.

SHA1 is the most frequently used hash function to generate HMACs. SHA256 and SHA512 could also be used for better security.

TOTPs (Time-based One-Time Passwords) extend the implementation of the HOTP by replacing the moving factor of the counter with time.

Describe the bug
When trying to parse the URI contained in a QR Code provided by Twitch the parsing fails.

To Reproduce
Steps to reproduce the behavior:

1. Go to twitch.tv
2. Log in and go to the Security settings of your account
3. Set up 2FA with app
4. Scan the QR Code with an app using Uno

Expected behavior
The QR Code is scanned successfully.

Additional context
The content of the QR Code is the following
otpauth://totp/Twitch?secret={SECRET}&issuer=Twitch

Description

We should add an object that describes the metadata of an OTP (information required for an OTP to be generated and associated to a service).

Most OTP secrets are Base32-encoded strings, so it would be nice to support it.
We might consider adding a library as a dependency, either third-party or created by ourselves.

Support for Secret instances initialised from a hexadecimal string should be evaluated for easier testing before the implementation of Base32 encoding/decoding.

Description

The counter update mechanism should be implemented for HOTPs.
Whenever a new HOTP is generated the counter is incremented by one. Every time the counter is updated, it should be stored (ideally in the Keychain).