chrismiceli/motp

Automatically exported from code.google.com/p/motp

motp's Issues

Add FreeAuth Support

As per the comment [1] on the Marketplace Review, a user would like support for 
FreeAuth. In [2] there's a link to the archive.org cache of the freeauth OTP 
generation psudocode, and in [3] is a concrete implementation of the OTP code 
for PHP.

[1] 
https://play.google.com/store/apps/details?id=org.cry.otp&reviewId=1337895351433
1718147
[2] 
http://web.archive.org/web/20100306020705/http://freeauth.org/wiki/index.php?tit
le=FreeAuth_Protocol_Implementation
[3] 
http://web.archive.org/web/20100306020757/http://freeauth.org/wiki/index.php?tit
le=One_Time_Passwords_with_PHP

Original issue reported on code.google.com by [email protected] on 2 Apr 2012 at 1:42

NumberFormatException

1. Add HTOP.
2. Leave DIGITS empty.
3. Clear ADD PROFILE.

// java.lang.NumberFormatException: Invalid int: ""
//  at java.lang.Integer.invalidInt(Integer.java:138)
//  at java.lang.Integer.parseInt(Integer.java:358)
//  at java.lang.Integer.parseInt(Integer.java:334)
//  at org.cry.otp.ProfileSetup$2.onClick(ProfileSetup.java:66)
//  at android.view.View.performClick(View.java:5204)
//  at android.view.View$PerformClick.run(View.java:21153)
//  at android.os.Handler.handleCallback(Handler.java:739)
//  at android.os.Handler.dispatchMessage(Handler.java:95)
//  at android.os.Looper.loop(Looper.java:148)
//  at android.app.ActivityThread.main(ActivityThread.java:5417)
//  at java.lang.reflect.Method.invoke(Native Method)
//  at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:726)
//  at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:616)

StringIndexOutOfBoundsException

Reproduce:

1. Select HOTP.
2. Input profile name, e.g., abcd
3. Click add Profile

// java.lang.StringIndexOutOfBoundsException: length=0; regionStart=0; regionLength=2
//  at java.lang.String.startEndAndLength(String.java:298)
//  at java.lang.String.substring(String.java:1087)
//  at org.cry.otp.ProfileSetup$2.onClick(ProfileSetup.java:73)
//  at android.view.View.performClick(View.java:5204)
//  at android.view.View$PerformClick.run(View.java:21153)
//  at android.os.Handler.handleCallback(Handler.java:739)
//  at android.os.Handler.dispatchMessage(Handler.java:95)
//  at android.os.Looper.loop(Looper.java:148)
//  at android.app.ActivityThread.main(ActivityThread.java:5417)
//  at java.lang.reflect.Method.invoke(Native Method)
//  at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:726)
//  at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:616)

Feature Request : Profile import & export

Hi, great app, use it all the time for work.

I tried to install it to my tablet as well so I had a backup keygen if my phone became unusable. There doesnt seem to be any way to copy a setup and I really dont want to bother my network admin with adding a second VPN account for me.

Could we please get an export/import feature so I can just clone the mOTP config on another device?

mOTP characters entered in the seed box

It may be beneficial to have a count of the number of characters entered in the 
seed box, perhaps like this:

Seed: (0/20 characters entered)
Seed: (5/20 characters entered)
Seed: (21/20 characters entered - too many!)

This link [1] seems to suggest it's pretty easy, but I've not got it working 
yet.

[1] 
http://stackoverflow.com/questions/3013791/live-character-count-for-edittext-and
roid

Original issue reported on code.google.com by [email protected] on 6 Apr 2012 at 9:55

Base32 seed input

Several applications present me with a Base32 secret.
Can this be added alongside ASCII and Hexadecimal input?

Original issue reported on code.google.com by [email protected] on 13 Jan 2014 at 4:35

Lack of clarity around secret/seed terminology

As per the comments on the market entry [1] [2], there is some lack of clarity 
around the terminology.

A seed helps to generate the secret which you install on the server. The 
terminology could be changed to show something along the lines of pre-secret 
seed, or perhaps the error message could show how to obtain the secret once 
you've created the profile?

Alternatively, you could have a button which generates the seed and tells you 
the secret once you've generated it.

I'm fighting with my Android Development environment, but I'll see what I can 
turn up as a patch over the next few days.

[1] 
https://play.google.com/store/apps/details?id=org.cry.otp&reviewId=1123502398957
1340957
[2] 
https://play.google.com/store/apps/details?id=org.cry.otp&reviewId=0107025327812
5732894

Original issue reported on code.google.com by [email protected] on 2 Apr 2012 at 1:18

Make generated password available on clipboard

As per the comment [1] in the marketplace entry;

"I'd love to continue using your app though others allow copying of the 
password. Do you plan on adding this functionality?"

[1] 
https://play.google.com/store/apps/details?id=org.cry.otp&reviewId=0135714995747
9833415

Original issue reported on code.google.com by [email protected] on 2 Apr 2012 at 1:34

[BUG] invalid code generated after last changes (version3)

the app stop working properly after release of version 3 (last changes?).
The codes generated are invalid (no settings of app were changed after update of the app).
online tool to check the code - https://totp.danhersam.com/

Cryptographic APIs misuses

I'm a PhD student interested in finding security vulnerabilities in open source projects.

We found a total of 11 warnings (indicating potential vulnerabilities) when running the CogniCrypt static analyzer (*) on motp (or its library dependencies). We documented each one of these issues in private gists for the sake of confidentiality (non-disclosure).

Can you please let us know whether we can share these gists with you? We are eager to evaluate the perception of developers (e.g. severity of these warnings) and improve motp's security, and the quality of the reports of static analysis tools.

(*) https://github.com/CROSSINGTUD/CryptoAnalysis

Provide epoch time for mOTP

To sync the tokens with some servers, they request an epoch value, or the 
calculated response from the pin 1111.

This patch adds a text box to the bottom of the token code generator, 
containing the epoch time.

Original issue reported on code.google.com by [email protected] on 6 Apr 2012 at 9:46

Attachments:

• epoch_patch