Scan QR code not working on v2.0.1

[traktofon]

Info

• Version: 2.0.1
• Source: Google Play
• Vault encrypted: Yes (with biometric unlock)
• Device: Motorola G100
• Android version and ROM: Andoid 11, security patch 1 July 2021

Steps to reproduce

1. Add a new entry via QR code from camera.. Camera opens but doesn't detect any QR code.

2. Open camera app and take photo of QR code. (Phone's camera app already shows the decoded text, so quality is ok.) Close camera app, open Aegis, and add new entry via QR code from image. Select the photo just taken. Result is Error, cannot decode QR code, details are com.google.zxing.NotFoundException.

What do you expect to happen?

Can add entry via QR code both from camera or photo/image.

What happens instead?

1. Camera doesn't detect any QR code.

2. Scan from image results in error com.google.zxing.NotFoundException.

[alexbakker]

Thanks for reporting this. We haven't received any reports of issues with scanning QR codes since v2.0 was released, so this is a bit surprising.

Do you have an example of a QR code that Aegis fails to scan, so that we can try to reproduce? Which website is showing you the QR code? Does Aegis fail to scan all QR codes or is it just the ones from this source?

[traktofon]

Thanks for your response. As far as I can tell this happens on all web sites with any QR code. I would like to not share the original website and QR code as it contains the OTP secret. But looking e.g. at the example QR codes on this page, the behaviour of Aegis 2.0.1 on my Moto G100 is that the camera opens but then simply nothing happens for any of the codes. In contrast, the builtin camera app on the same phone pops up a notification with the decoded text for all these QR codes. Also in contrast, I tried Aegis 2.0.1 on an older phone (HTC, running Android 8) and there the above QR codes all produce a response -- they all pop up an error about the protocol not being supported (which is expected as none of these codes are Authenticator codes). Also, on the older phone Aegis was able to detect and decode the authenticator QR code that gave me trouble.

The odd thing is that scanning from an image also doesn't work (on the Moto G100) with, as mentioned, the com.google.zxing.NotFoundException error. AFAIU zxing is a Java library for decoding QR codes, perhaps it has an issue on this phone or with Android 11? I will try to produce a valid authenticator QR code which doesn't contain any sensitive information, and (expecting that Aegis will run into the same error) will share this with you.

[traktofon]

Ok, here is a valid authenticator QR code, generated by this web site.

As expected, on my Moto G100 Aegis doesn't detect anything when scanning. (I've tried orienting the camera sideways and upside down as well, to no avail.) Using the phone's camera app (which is able to decode the code) I took the following photo:

This is the original image as saved by the camera app, except that I stripped all exif data for privacy, which is why it appears here rotated. The original orientation is correct. I've then tried Aegis "scan image" with this image, resulting in the error:

An error occurred
Unable to read and process QR code
com.google.zxing.NotFoundException

Seeing that the (exifless) raw image is rotated, I've used exifautotran to create a jpeg with the correct orientation and without recompressing, and subjected that image to Aegis "scan image". The error is now slightly different:

An error occurred
Unable to read and process QR code
com.google.zxing.FormatException

That said, I've found a workaround: As my phone's camera app can decode the QR code, I can simply tap the notification with the decoded otpauth:// link and choose to open it in Aegis, which adds the entry without problems.

[InfiniteCoder06]

@traktofon Is it working in v2.0?

[alexbakker]

Thanks for the extra information. I'll work on a debug build with some additional logging so that we can get some more info on what data CameraX is processing on your device. Glad you've found a workaround in the mean time.

[ChicoBento-dev]

having the same issue. Camera is not reading the QR code. I'm able to read the QR with my camera, however not while using the app
Note 10+ running Android 11
Aegis version 2.0.2

[ChicoBento-dev]

having the same issue. Camera is not reading the QR code. I'm able to read the QR with my camera, however not while using the app
Note 10+ running Android 11
Aegis version 2.0.2

enabled QR on my "Camera" app and was able to scan multiple QR.
-only one not reading is AOL mail, however it worked/authorized when I entered the key manually.

[paolo-caroni]

Same problem with 2.0.2, download from f-droid, android 9 (lineageos). The qrcode scan soesn't work. i have to tipe the code manually.

[daks]

On version 2.0.2 from f-droid on LineageOS 10, no problem scanning this ACME QRCode

[wafer-li]

Nowadays the QR Code Scanning is back by Machine Leaning.

Maybe we could use the Google ML Kit Barcode Scaning to replace the zxing

[v-fox]

Didn't work for me with 2.0.2 from F-droid on Xiaomi RedMi Note 4x running ResurrectionRemix Android 10. Tried on https://code.videolan.org/-/profile/two_factor_auth

[InfiniteCoder06]

Nowadays the QR Code Scanning is back by Machine Leaning.

Maybe we could use the Google ML Kit Barcode Scaning to replace the zxing

@wafer-li We can use but using it requires Google Play Services, This app needs to be independent and not dependent on Google

[InfiniteCoder06]

Didn't work for me with 2.0.2 from F-droid on Xiaomi RedMi Note 4x running ResurrectionRemix Android 10. Tried on https://code.videolan.org/-/profile/two_factor_auth

I too have got the issue

[wafer-li]

Nowadays the QR Code Scanning is back by Machine Leaning.
Maybe we could use the Google ML Kit Barcode Scaning to replace the zxing

@wafer-li We can use but using it requires Google Play Services, This app needs to be independent and not dependent on Google

@Hacker437 Actually, it is not the case, the Google ML Kit Barcode Scanning offer a bundled version of itself, and do not require the Play Services.

Although it will increase the APK size for around 3MB

[InfiniteCoder06]

Nowadays the QR Code Scanning is back by Machine Leaning.
Maybe we could use the Google ML Kit Barcode Scaning to replace the zxing

@wafer-li We can use but using it requires Google Play Services, This app needs to be independent and not dependent on Google

@Hacker437 Actually, it is not the case, the Google ML Kit Barcode Scanning offer a bundled version of itself, and do not require the Play Services.

Although it will increase the APK size for around 3MB

Have to test it!

[themrvideouser]

As a workaround you can use this QR Code Scanner SecScanQR https://f-droid.org/en/packages/de.t_dankworth.secscanqr/ available on F-Droid

[shiroyagi]

Same with Yahoo, but various other QR codes are fine.
It would be nice if it gave an error message from the camera, rather than just ignoring the code.

[terriyu]

Encountering the same bug.

Aegis version: 2.0.3
Device: Google Pixel 4
Android version: 11

Behavior:
When I try "Scan QR code", the camera opens but no QR code is scanned.

Behavior:
If instead I try "Scan image" using a photo of the QR code, I get
An error occurred
Unable to read and process QR code
com.google.zxing.NotFoundException

Additional notes:
I was able to scan the same QR code using a different authenticator app (Google Authenticator).

[DoubleMCA]

I am also having this issue on my Google Pixel 3a. I am unable to scan QR codes to add to Aegis.

[glenneroo]

I am also getting the same error trying to scan a QR code of google authenticator export in order to import my 2FA codes:

An error occurred
Unable to read and process QR code
com.google.zxing.NotFoundException

So I installed Zxing app from the play store (from Zxing Team) and now I get this error:

Unable to read and process QR code
com.beemdevelopment.aegis.otp.GoogleAuthInfoException:
Unsupported protocol: otpauth-migration

[terriyu]

I recently scanned a QR code successfully with Aegis. It's still the same version, Aegis v2.0.3

Not sure why it's working now. Something must have changed behind the scenes, maybe at Google?

[Mountain-Eagle]

Aegis v2.0.3, vault encrypted with password, Samsung Galaxy A20, Android 11
QR code worked OK for setting up 2FA on 20 other websites.
QR code not detected for Yahoo set up. No message. Had to enter setup code manually. Working OK.
QR code for Yahoo is recognized normally by Google Authenticator.

[alexbakker]

The latest beta release features various reliability improvements for the QR code scanner: v2.1-beta1. Both for images and for camera. Please give it a shot and let us know if you can still reproduce this issue.

[alexbakker]

v2.1 is out! For those of you who were having issues scanning QR codes, please let us know whether the situation has improved. If so, we'll go ahead and close this issue.

[terriyu]

I just tested v2.1 and scanned a QR code. It worked.

[traktofon]

Many thanks for your continued efforts to work on this issue.

Unfortunately for me, on v2.1 scanning QR codes still doesn't work. Same behaviour as before, the camera opens and shows what it "sees", but no code is detected.

Moreover, my previous workaround of using the phone's built-in camera app to detect the code and then open the otpauth link in Aegis no longer works. The camera app still detects the code, but only shows the decoded text (otpauth://...) and offers to copy it to the clipboard, but doesn't offer to open it in Aegis, nor in any other app. I've looked at the Aegis app's "open by default" settings, but everything there is greyed out. But the same is true for other authenticator apps (I have Google's and Microsoft's installed.) It's as if the otpauth protocol is not recognized as something that can be opened in apps. This is probably a problem with my phone or with Android. I know this used to work, maybe the powers that be decided that this feature must be disabled for my "protection" or whatever.

FWIW, Google authenticator has no problem scanning the QR code and adding the OTP entry.

What does work now for me (compared to v2.0.1) is that I can take a photo of a QR code, and then use Aegis' scan from image. So thanks very much for fixing this! I guess this will be my new workaround. However, if #1033 could be implemented, that would be a more convenient workaround.

[alexbakker]

Thanks for reporting back. I'm very confused as to why QR code scanning still doesn't work at all on some devices. I thought we had things all ironed out with fb58c87 and the recent support for scanning slightly invalid QR codes. We'll have to come up with some elaborate debug logging for QR code scanning and ask one of you to run some tests on your devices, but I'm not sure yet when I'll be able to get to actually implementing that.

[mmallejac]

Same issue with Samsung 10e / Aegis 2.1.3 / Keycloak
Using other phone QR code reading app works fine.
Also tested using https://zxing.org/w/decode with uploaded QR code image -> works fine

Also tried with https://play.google.com/store/apps/details?id=com.google.zxing.client.android app -> works fine
But this app doesn't look the same as Aegis scan looks :

• the ZXing app show a rectangle with a central red line, with a central zone clear and blurred around
• the Aegis app shows an almost full size photo mode, without central rectangle and red line

[Mountain-Eagle]

Aegis v2.1.3, vault encrypted with password, on Samsung Galaxy A20, Android 11, external VGA display Vizio 26" TV/monitor.
On my most recent QR scan, for MEGA cloud storage, I noticed it did not work when I held my phone close to the display screen, but it worked when I held my phone further away.
I always assumed a shorter distance was better, for a close-up view, but that assumption is not correct. When my phone is placed near the display, it causes some distortion in the QR code, maybe due to radio frequency interference (RFI).
My phone is connected to Wi-Fi on the 5 GHz channel.
Maybe testers should mention the scanning distance from the display, trying short and longer distances.

[gavsiu]

Aegis v2.2.2 on Samsung Galaxy S22 Ultra with Android 13 doesn't work either. I was set on switching everything over from Google, but this 2 year old problem is making me have second thoughts.

I tried everything. I tried installing the Google Play and Fdroid versions. I tried rotating my phone 360 degrees. I tried both front and back cameras. I tried setting my laptop brightness to 100% even though my other camera apps can decode the QR code without issue at 60%. I tried tapping the screen because maybe it needs me to tell it to do something? I tried close up and far away. I tried with or without password protecting the vault.

This was the one 2FA I use the most as it was for work. It was for a Microsoft account. It also seems to affect only Samsung phones. Anyone with a Samsung phone confirm it works?

Tested both Google Authenticator and Aegis on this website. Instantly added to Google, but Aegis refused to read it. It does work if I scan with the Samsung camera app and open it with Aegis.

Seems like there's a lot of reference to a com.google.zxing. I downloaded the Barcode Scanner from ZXing Team on Google Play and that scanner cannot read the 2fas.com test token as well.

[alexbakker]

There's still some things we can do to try to help ZXing find the QR code. Like not asking it to scan the full image, but just the portion inside the rectangle of a viewfinder that we could introduce, like some other QR scanning apps do.

Are you able to scan QR codes using https://github.com/GrapheneOS/Camera on that device?

[gavsiu]

Yes, their version of the ZXing can read both Microsoft phonefactor QR and the 2FAS otpauth QR codes. I thought I could get by with scanning in the Samsung camera app and opening the link in Aegis since it worked for the otpauth links, but Aegis cannot open phonefactor links. Which makes me wonder if I will be able to add that TOTP to the app later if the camera works.

[alexbakker]

Yes, their version of the ZXing can read both Microsoft phonefactor QR and the 2FAS otpauth QR codes.

Thanks for checking. Looks like there's still room for us to improve here.

but Aegis cannot open phonefactor links

Phonefactor is a proprietary Microsoft thing that Aegis can't and doesn't support.

[gavsiu]

I found this and created the alternate QR code. So I was able to add the Microsoft TOTP using the Samsung camera. It would be nice if the Aegis camera would work.

Edit:
So, I found that Facebook QR code worked in app. That made me question the 2FAS.com QR code for being too big and pixelated. I tried zooming the page out and that actually worked. I'm starting to believe maybe my issue is resolved. Thanks.

[alexbakker]

For those of you still having issues scanning QR codes with Aegis, please install this debug APK and:

• Start Aegis' QR code scanner
• Tap the three dots in the top right, tap "Capture debug info" and select a location to store the debug capture.
• Aim the camera at this QR code, make sure it's up close and sharp. Then press the "Capture" button that appears at the bottom right. You should see a toast saying "Debug capture successful".
• Share the resulting ZIP file here.

By sharing the ZIP file you'll be sharing the full image your tried to scan, so make sure it is not an actual 2FA QR code for one of your actual accounts.

The debug APK is based on this patch: alexbakker@708f5d0

[kriks57]

-- Link removed --
Hope this helps !

[alexbakker]

Thanks, that looks like a sharp image to me.

It is fairly large though: 4608x3456. ZXing is known to struggle with high resolution images. That's why we try a couple of different sizes when scanning from an image, and ask CameraX for a resolution somewhere in the neighborhood of 1600x1200, though in your case we still somehow ended up with 4608x3456.

I noticed that https://github.com/zxing-cpp/zxing-cpp has been seeing some more activity recently, including a wrapper for Android. I'll experiment with that.

[alexbakker]

I've experimented a bit with zxing-cpp: alexbakker@28fe2a2. It's able to scan that high resolution image.

Couple of downsides:

• APK size increases by a couple of megabytes
• The Android wrapper for zxing-cpp does not expose QR code generation functionality. So we may end up with a dependency on ZXing and zxing-cpp
• No x84 and x86_64 support: x86 and x86_64 ABI support for the Android wrapper zxing-cpp/zxing-cpp#736

I think we have two options:

• Switch to zxing-cpp
• Stick to ZXing but help it scan the image by introducing a view finder and cropping the image.

[axxel]

Thanks @alexbakker for reaching out. I'm the maintainer of zxing-cpp and have couple of thoughts:

I've experimented a bit with zxing-cpp: alexbakker@28fe2a2. It's able to scan that high resolution image.

Couple of downsides:

* APK size increases by a couple of megabytes

That should be like 1.5MB at most, I believe. Is that what you consider "a couple"?

* The Android wrapper for zxing-cpp does not expose QR code generation functionality. So we may end up with a dependency on ZXing _and_ zxing-cpp

That is true a.t.m. but there are two things to notice:

• this is mainly caused by the issue that I did not want to introduce a new API that will change 'soon' after. Time went by and nothing much happened in that regard. But coincidentally I picked up this subject again this week. So there might be a change relatively soon.
• there is a fork of zxing-cpp by @markusfisch that has built in writer support.

* No x84 and x86_64 support: [x86 and x86_64 ABI support for the Android wrapper zxing-cpp/zxing-cpp#736](https://github.com/zxing-cpp/zxing-cpp/issues/736)

I'm definitively open to add this. We'll discuss it at the linked issue.

I think we have two options:

* Switch to zxing-cpp

Go for it! :)

* Stick to ZXing but help it scan the image by introducing a view finder and cropping the image.

If you want to stick with ZXing, simply cropping the image will not help (except for performance). Downscaling the image will. And if you do that already but it is not enough, you are likely out of luck. Note that while zxing-cpp started out as a port of ZXing, particularly the QRCode detector is completely rewritten and is now considerably faster while detecting a lot more difficult input at the same time.

[alexbakker]

That should be like 1.5MB at most, I believe. Is that what you consider "a couple"?

Just looking at libzxingcpp_android.so, let's assume it's 500KB for every ABI. (It's actually a bit larger for both armeabi-v7a and arm64-v8a). Assuming the other two that may be added for x86 and x86_64 are similar in size, we're looking at an increase of 2MB, a ~35% increase in APK size for Aegis.

Not saying it's not worth it. Perhaps it is.

[axxel]

For what it's worth, I just reduced the size of each binary by approx. 90kB

[bdr2]

I was having this same QR code scanning problem on some websites. What worked for me was disabling the Dark Reader extension on Firefox. (Makes webpages in "dark mode".) As soon as I disabled it and made the background all around the QR code white, Aegis scanned the QR code just fine.

If anyone else is trying to scan QR codes with dark/black backgrounds (whether a theme or from a browser extension), I recommend trying with white/light instead.

[alexbakker]

Dark mode extensions mangling web interfaces is a known but different issue.

[marblewraith]

I've also had issues with QR codes.

For example X (Twitter) their QR code worked perfectly fine. But i tried to add a QR code from dropbox (made sure dark mode was disabled)... nada and not just aegis but other QR readers didn't recognize it either.

Possible Solution: OCR?

Disclaimer: I'm not an android dev / familiar with aegis architecture, so please forgive the following ignorance.

Many websites also have the option to "enter your secret key manually" which is how i've ended up having to add them.

The issue being those keys, much like software product keys in ye ol' times before the internet / subscription models were the norm, can be 20+ character monsters and a real pain to enter on a smartphone keypad.

With that in mind... what are the thoughts on adding OCR to aegis?

In theory it should be just as convenient as a QR code.

In addition it also has the potential, to prevent a whole class of attacks via keyloggers. Since a touch keypad on android is, at it's core, just software (and customizable / replaceable by the user) it's vulnerable to that kind of exploit. With baked-in OCR there'd be no need to ever use the keypad thus preventing a catastrophe of having your seeds stolen.

[linuxtopia]

I can't also scan dropbox's 2FA QR code with Aegis from F-Droid.