Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

copy-able secret key on 2fa setup #1289

Open
4 tasks done
not-ivy opened this issue Apr 19, 2024 · 1 comment
Open
4 tasks done

copy-able secret key on 2fa setup #1289

not-ivy opened this issue Apr 19, 2024 · 1 comment
Labels
improvement Something can be added or improved

Comments

@not-ivy
Copy link

not-ivy commented Apr 19, 2024

Checklist

  • I've checked both open and recently closed issues to ensure this feature is not already requested.
  • I am using the newest version of TETR.IO.
  • I am certain this is a feature request, not a bug.
  • I've thought this feature through properly.

Is your feature request related to a problem? Please describe.

currently, there is no way to copy the secret key while setting up totp. however, most desktop passwords(keepassxc, the one i am using) requires a secret key to setup totp like this:
keepassxc's totp setup screen

Describe the solution you'd like

add a button or a section to reveal the secret key so it is able to be copied. it would also help for devices which camera would not work or could not scan the qr code.

Describe alternatives you've considered

scanning on phone i guess and copy the key over to the computer which might kind of be a hassle

Additional context

No response

@not-ivy not-ivy added the improvement Something can be added or improved label Apr 19, 2024
@ZaptorZap
Copy link
Member

There are plenty of methods to get the secret off what's shown. You could just use a QR code reader such as ZBar to just render the QR code locally. I believe you can just take the QR code's URL and copy the bit between secret= and % as well, but I was unwilling to completely remove 2FA from my account to test the new fix for the previous 2FA issues fixed by 6.4.4. For all I know the "URL" is just incomprehensible Base64 now.

But as always, if the device you're logging in with is the 2nd factor, then you aren't using 2FA properly. This provides little extra security and simply brings the potential for permanent account loss if you lose access to this device. This is why I believe there's motivation to confirm that a 2FA is in fact being set on a 2nd, unique device. I don't think I have the authority to close this issue without implementation, but the technological expertise of TETR.IO's demographics would definitely lead to a couple people gluing together "2FA makes my account more secure"→"I can just generate it online(allegedly)" and irretrievably losing access to the account.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
improvement Something can be added or improved
Projects
None yet
Development

No branches or pull requests

2 participants