paolostivanin/otpclient

Highly secure and easy to use OTP client written in C/GTK3 that supports both TOTP and HOTP

OTPClient

Highly secure and easy to use GTK+ software for two-factor authentication that supports both Time-based One-time Passwords (TOTP) and HMAC-Based One-Time Passwords (HOTP).

Requirements

Name	Min Version
GTK+	3.24
Glib	2.68.0
jansson	2.12
libgcrypt	1.10.1
libpng	1.6.30
libcotp	3.0.0
zbar	0.20
protobuf-c	1.3.0
protobuf	3.6.0
uuid	2.34
libsecret	0.20
qrencode	4.0.2

⚠️ Please note that the memlock value should be >= 64 MB. Any value less than this may cause issues when dealing with tens of tokens (especially when importing from third parties backups). See this wiki section for info on how to check the current value and set, if needed, a higher one.

Features

• integration with the OS' secret service provider via libsecret
• support both TOTP and HOTP
• support setting custom digits (between 4 and 10 inclusive)
• support setting a custom period (between 10 and 120 seconds inclusive)
• support SHA1, SHA256 and SHA512 algorithms
• support for Steam codes (please read THIS PAGE)
• import and export encrypted/plain andOTP backup
• import and export encrypted/plain Aegis backup
• import and export plain FreeOTPPlus backup (key URI format only)
• import and export encrypted/plain AuthenticatorPro backup
• import and export encrypted/plain 2FAS backup
• import of Google's migration QR codes
• local database is encrypted using AES256-GCM
  • key is derived using PBKDF2 with SHA512 and 100k iterations
  • decrypted file is never saved (and hopefully never swapped) to disk. While the app is running, the decrypted content resides in a "secure memory" buffer allocated by Gcrypt

Testing

• Before each release, I run PVS Studio and Coverity in order to catch even more bugs.
• With every commit to master, OTPClient is compiled in CircleCI against different distros

Protobuf

The protobuf files needed to decode Google's otpauth-migration qr codes have been generated with protoc --c_out=src/ proto/google-migration.proto

Wiki

For things like roadmap, screenshots, how to use OTPClient, etc, please have a look at the project's wiki. You'll find a lot of useful information there.

Manual installation

If OTPClient hasn't been packaged for your distro (check here) and your distro doesn't support Flatpak, then you'll have to manually compile and install OTPClient.

1. install all the needed libraries listed under requirements
2. clone and install OTPClient:

git clone https://github.com/paolostivanin/OTPClient.git
cd OTPClient
mkdir build && cd build
cmake -DCMAKE_INSTALL_PREFIX=/usr ..
make
sudo make install

License

This software is released under the GPLv3 license. Please have a look at the LICENSE file for more details.

otpclient's Issues

change password action should ask for the old one

before it can be changed

save window and treeview geometry, treeview column autofit

• when a long label/issuer is used, the window should be automatically resized (up to a certain point)
• save window and treeview sizes into the cfg file

Incorrectly hardcodes ~/.config path

Use https://developer.gnome.org/glib/stable/glib-Miscellaneous-Utility-Functions.html#g-get-user-config-dir

add icons to treeview

• download favicon/icon
• optional feature, disabled by default

⚠️ this would increase the db size quite a bit, thus making it more difficult to store all the data in memory. I can see only three options here:

1. don't implement this feature
2. icons are downloaded every time the app is launched
3. refactor the app to load in secure memory only the important stuff and not the icons

replace json-glib with jansson

jansson supports custom memory allocation, meaning that gcry_calloc could be used to allocate secure memory. Right now, the data parsed by json-glib is not stored in a secure memory location.

http://jansson.readthedocs.io/en/latest/apiref.html#custom-memory-allocation

secure memory

Currently, the program is trying to allocate MAX_FILE_SIZE bytes of secure memory. It can be that a system doesn't have so much secure memory available.

1. reduce sec mem size
2. use mlock on normal memory
3. erase normal memory

mlockall(MCL_CURRENT | MCL_FUTURE)

add shippable support

cloud sync

It would be handy to have a cloud backup option integrated directly into the software.
Providers that could be supported:

• webdav
• dropbox
• google drive
• ...

Feature Request:barcode scanner

Feature Request:
barcode scanner

g_free text after use

OTPClient/src/app.c

Line 82 in e0d792f

gchar *header_bar_text = g_malloc (strlen (APP_NAME ) + 1 + strlen (APP_VERSION) + 1);

update docu

• Mac OS 10.13 works again (update installation instruction for jansson)
• new screenshots

duplicates handling

• prevent duplicates to be added on import
• show warning when a duplicate wasn't added

default secure memory pool size on ubuntu 16.04

On Ubuntu 16.04, the secure memory pool can only be increased by root (so only 16 KB can be used by default). This means that either the app has to run with sudo or it must be installed as "setuid(root)".

edit fields

add possibility to edit issuer and label fields

add import feature

• authplus support ✅
• andOTP support ✅
• add import button ✅

add winauth support

Implement:

• import
• export

https://github.com/winauth/winauth

Easier token add (scan/upload barcode)

The token add workflow is a bit scary for newer users (lots of text boxes without much explanation). It should be possible to make a simpler capture experience - perhaps by using a laptops webcam and a QR code parsing library - or more clearly explaining how to get the information for a series of popular services.

add clang-format/uncrustify file

write a .clang-format/uncrustify file, so contributors can use it before submitting a PR

https://clang.llvm.org/docs/ClangFormatStyleOptions.html
http://uncrustify.sourceforge.net/config.txt (first draft: uncrustify.txt)

unref json_array after use

OTPClient/src/db-misc.c

Line 72 in e0d792f

ja = json_array_new ();

add authy support

Implement:

• import
• export

encryption spec

copy otp value

by double-clicking or ctrl+c

missing g_free

OTPClient/src/db-misc.c

Line 116 in e0d792f

HeaderData *header_data = g_new0 (HeaderData, 1);

use ui files

use .ui files to create the ui. This will reduce the amount of code and make the codebase more maintainable

use linux capabilities to set cap_ipc_lock

• setcap cap_ipc_lock=ep
• remove "known issues" from readme

Be explicit (== 0)

OTPClient/src/common.c

Line 78 in e0d792f

if (!g_strcmp0 (gtk_widget_get_name (children->data), widget_name)) {

add exports (andOTP)

export data to an encrypted json supported by andOTP

add icon

I have no graphic skills, so I can't create a nice icon :(

Needed icons would be:

• 32x32
• 64x64
• 128x128
• 256x256
• 512x512

add exports (Authenticator Plus)

• export data to authenticatorPlus supported format (https://authenticatorplus.freshdesk.com/support/solutions/articles/5000541895-technical-details-of-authenticator-plus)

migrate from key_file to json

To have better flexibility, the db file should be in json format and not a simple key_file

importing wrong file causes a crash

happens only when using "andOTP"

add flatpak

Packaging is really time expensive, thus only sources and flatpak will be available

Wrong app-id

In main.c you use org.gnome.OTPClient instead of com.github.paolostivanin.OTPClient.

Explain why you want the password

I installed the OTPClient flatpak and the first thing I was presented with was a dialog window that just asked for my password twice. Now having a read into this a little bit i knew why, and wasn't too distressed but a less educated user would be somewhat disturbed. It might be nice to explain a little more about why you want a password and what it'll be used for.

Create a blank slate experience

When you start the application for the first time you get a fairly unfriendly blank slate experience with and empty list and a countdown above it that doesn't apply to anything.

Ideally there would be a custom blank slate experience that shows the user that they need to press the + button to add a token or use the menu to import.

Prepare release v1.2.0

• update screenshosts ✔️
• update appdata file ✔️
  • update also screenshots urls ✔️
• test on:
  • ubuntu 18.04 ✔️
  • debian 9 ✔️
  • fedora 27 and 28 ✔️
  • arch linux ✔️
  • flatpak ✔️
• update flatpak manifest on flathub with new deps and settings (dbus and webcam access) ✔️
• create detached signature (#85) ✔️

Add debian 9 compatibility

Debian 9 is using glib 2.50, and this software requires glib 2.54 just for this line:

OTPClient/src/parse-data.c

Line 133 in 7fc1006

g_ascii_string_to_signed (digits_str, 10, 5, 9, &digits, NULL);

1. replace this function with strtoul
2. test again on debian 9

improve UI and add keyboard shortcuts

Evaluate switch to GtkListBox and global ui file:

• cleaner ui
• can be used on small screen (eg, librem 5)
• accels can be easily added when using one single ui file
• codebase becomes cleaner if the ui part is taken out

Update appadata

OTPClient/data/com.github.paolostivanin.OTPClient.appdata.xml

Line 4 in f2b56b4

<id>com.github.paolostivanin.OTPClient</id>

change to
<id type="desktop">com.github.paolostivanin.OTPClient.desktop</id>

update also description

do not exit on wrong password

when a wrong password is given, the program should ask for the password again instead of exiting

add snap support

unref json_node after use

OTPClient/src/parse-data.c

Line 42 in e0d792f

jn = get_json_node (widgets, acc_label, acc_iss, acc_key, i);

add select from file option

Taking a screenshot is not enough because this feature needs gnome-shell. In order to facilitate the import operation on other DEs, a "select from file" option should be implemented.

Add Battle.net support

Implement support for Blizzard battle.net

change master password

Add possibility to change master password

add search

search label or issuer

replace custom realloc with garray

https://github.com/paolostivanin/OTPClient/blob/devel/src/add-data-dialog.c#L132

copy otp when selected

when otp is selected, automatically copy it to the clipboard

ask for password twice on first run

typos are always behind the corner

add CI

Would be nice to have distro specific deb and rpm. Should think about setting up something

flatpak hardening

• use only a specific folder (for example, app's .config folder)
• update manifest