Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Change 2FA to use hostname as issuer (fixes #4518) #4525

Merged
merged 1 commit into from Mar 11, 2024
Merged

Conversation

Nutomic
Copy link
Member

@Nutomic Nutomic commented Mar 11, 2024

Im not sure if this is backwards compatible with existing 2FA tokens or if this is a breaking change.

@dullbananas
Copy link
Collaborator

Probably backwards compatible because totp_rs appears to only use the secret when signing timestamps, but I might be wrong

@dessalines
Copy link
Member

That sounds right, AFAIK the issuer name is only to help you add it to your TOTP client.

I'm not sure, because it looks like even the check_totp_2fa_valid function requires you to rebuild the TOTP with the issuer name.

@constantoine does a TOTP check require a correct issuer name?

@constantoine
Copy link

constantoine commented Mar 11, 2024

@dessalines issuer is only useful for generating the URI that will be scanned by the TOTP Client, and is used for disambiguation purposes

The only thing used for a check is indeed the secret key (and timestamp), so this will not affect token generation in any way

@dessalines
Copy link
Member

Sweet, thx!

@dessalines dessalines merged commit 5d361d6 into main Mar 11, 2024
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants