From 20b85eb966bdf5faafe7be7aec3c5676bb6df51a Mon Sep 17 00:00:00 2001
From: sil <sil@kryogenix.org>
Date: Sun, 8 Sep 2013 12:29:02 +0100
Subject: [PATCH] Initial import

---
 .htaccess                           |   2 +
 README.md                           |  10 +
 canauth.appcache                    |   6 +
 canonical_aubergine_hex_crushed.png | Bin 0 -> 6757 bytes
 favicon.ico                         | Bin 0 -> 1150 bytes
 index.html                          | 528 ++++++++++++++++++++++++++++
 6 files changed, 546 insertions(+)
 create mode 100644 .htaccess
 create mode 100644 README.md
 create mode 100644 canauth.appcache
 create mode 100644 canonical_aubergine_hex_crushed.png
 create mode 100644 favicon.ico
 create mode 100644 index.html

diff --git a/.htaccess b/.htaccess
new file mode 100644
index 0000000..b1f8462
--- /dev/null
+++ b/.htaccess
@@ -0,0 +1,2 @@
+AddType text/cache-manifest .appcache
+
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..ccf3f0b
--- /dev/null
+++ b/README.md
@@ -0,0 +1,10 @@
+Canonical Two-Factor Auth HTML5 client
+=======================================
+
+[Ubuntu One login](https://login.ubuntu.com), used for many Ubuntu and Canonical services (the Ubuntu wiki, Discourse, Ubuntu One itself, Launchpad, etc) has the option of allowing two-factor-auth. This is implemented using HOTP, a standard way to do this: when you log in, you go to your HOTP device and generate a new code, and then use that code along with your password to log in. There are many HOTP clients out there: Google Authenticator is a common one. It's nice to not have to rely on a native app, though, especially if that native app is not available for your platform.
+
+Therefore, an HTML5 client-side app.
+
+This is not specific to Ubuntu One login: this code is actually a completely generic JavaScript HOTP client for HTML5. It was written for Ubuntu One sign-in, though, so that's the language it uses.
+
+It comes with an appcache, so if it's served over HTTP, it can be bookmarked as an "app" and will work offline. It contains no server components, so your HOTP keys are not used or even seen by the server.
diff --git a/canauth.appcache b/canauth.appcache
new file mode 100644
index 0000000..3c67f7f
--- /dev/null
+++ b/canauth.appcache
@@ -0,0 +1,6 @@
+CACHE MANIFEST
+# version 4
+index.html
+canonical_aubergine_hex_crushed.png
+favicon.ico
+
diff --git a/canonical_aubergine_hex_crushed.png b/canonical_aubergine_hex_crushed.png
new file mode 100644
index 0000000000000000000000000000000000000000..e739287ec956c0aef74c46f848497590b8708232
GIT binary patch
literal 6757
zcmV-r8k*&aP)<h;3K|Lk000e1NJLTq0043T0043b0ssI20KXC{00001b5ch_0Itp)
z=>Px#24YJ`L;(K){{a7>y{D4^000SaNLh0L01FcU01FcV0GgZ_00007bV*G`2iyY;
z3?>l-D(Nl&02$>;L_t(|+U;G3TNBw9&)>1G4Mn1B-+k*_eXd(vl^y~DqN|G?S0Io=
zLX%#lh$5>XSSX69fKn6`Pyt1XAc_<PX;K6P=|$g}nJ^5KWHN!!_H(}Z@`aGh-1*&8
ze&^hK&t-i1dQ8E=_zJ;SSii#h71poEzZurgpFhv|75*i#N(BNw8tfZ*Us?P5QPI=5
z^sMlN)WE1@|48KYyOJJqJtsQ#c}jLoQTeA2AEjSmrtxLW20(j0eyT66Do)A1<8$e}
zsgwJb!}jZp?baIGt~Rn=Wh7c<C|bD_JB7%rA$$V=vRi|E$6>w6DK_t#C@4EJx#~$t
zTU|4L<rxH*F(Xn5e+~}~cei&vi@P7q4e;0D*sU|>FJtl5^aM;coHon#;Y8kyzLz|S
zUxVNBma&8@3_O23a?aEVq`U4#)$q{J$jHcyNHJrYF$FYxI=ZT!ya+$+29hXH)8j7H
z;Vsh>sIiG)5y7Q6Nnb<p)#EMI<*DkzpI%#!J-l?gtEGLQx9{I3tvIIr-MvkfwK>r#
zK0E%loUdWML<cY>2^}3MY2s_c)aR?RI1AK418zE<gO2QK?f5+Md3t1)F{OZF4=~Wv
zSCLbE+v}qDwqu-yn!Ketf=S~@2WasdH9gLJ4KT!)j(O$9rMFZ!OoKsSOtp}fKPtK=
z407Lc2r+-4n@sevnfg-)s8kUKaIF?<+OOLcvfJ*_<vV>{JyQxUW9k3}rHiu<cK_ut
zUsV_Mah$R*pK?scz(wvTeh&r#S|VC)c>XWP())QNt(v{CV(o+1!o;iqmNkN)n%J9T
zvNH`rDnoJsUp9s>=GmM#n#Q|?c75oW3bAD<T}V5d+ph^vJN~d62N4xdeVf^FqOBTx
z58SRSvjCTd*##@!tlE+a?`>vaM!|XlizK=Zg<K6PS?p02W|K}y-a4_nAZB5i9`L;T
z|HKXU4=52_hO#gn8W=21djbxZtIC>y%43vBFy35<Pc_0T@eSz~XzZZS9r4>)e6u~y
z@$9GePGuPchEgzv=riN|4XZ_({P9$j=Ck3C2eJb$g||!>V$%~p?seUK!1K4mKHHCh
zss`$Dk(0&sRX^^v^{CsHL(V__WxswG{E)j;7x^K2YlUqN_T?4&oCO*XH$!Zu6l58b
z0TjD;XLDN&FAy-rA|?9K5kV7KR*SSC`t*R%bDtxGv#9}5Ph-<wW#rcsmNmS3+x)h^
zwWbj}-<Q|al~w@}F1($U5qb-#e)ti0e;q5kwZ@hUG$6#nLtgr!nhlC9cZs(5AIDy%
zKb<_Xj7iFAM`O#yW1fHuE^!LjH8mvAv|g<3ve7g~5cn`6u`;JvR#J+hAp?E=0DVD1
z<{j^gfovXhkCloxPnFOld9A`b0HogS=Yu7w*^@+;F-c4#%skKrvFWf;qP|-%)&fmG
zy;G1C9{=undEciV1u}=SpSHQGt~ez-h93xBg@KEhY<iMAiY#mL$TB93Dd>KLnWv;*
zmMf$no}h6tynq+?o^-af4-X9~CBsDgZSTiVjjwC&23_^lFgKsK9d0dLZa}+{NIneA
zdP!=|gt-A@!agdR7syl9ql4*~q%id@=4}r@;#ON+(cjyLXYC~0P4h{pe+cBHy}mi?
zLcHx7BkmGil&-SnH5HdxJ@+jKYl>b^hY`TJ6zcc2<gzI2Ul@S}OL}6%zWn%%kzpxl
z5_8Y^0k{tj4Ws7};Y2=xix9s_-5+2X&h2$T8JIpzIe=H*5}g2DYf#DwM7I->))#5H
zR*SW4m~`7GVCvbgGr4fY9TZb4h~oDnBf!bKT081W-@M9rmKC0G)h6hSvC#dO!?vpo
zkt8>GAvHGeDnD&b#8HnV-^<VMJgUww`|$4lKySZPV}f5F{+oU_)^+oKn)zJpzaTo`
zko$Z36g345MMV|jDA8&|x%?DwH~3}uUk(9A0GTWa1?lT(Y<>0M*=^78U=xwkfA?_~
zXmS>6TB~RSC*>iWbd3BX{6SThyF>?`*<#)f(W;$(nif%3emOBI4Q17MYD%hQs4gfA
z*<(L0s-}Dd&@;|_4d8IYgF^}-%TNf@kIiks?0BPb6dmt$Qp>XZaiOFT;a6@bd;8$r
z4L@xw(JCYBCE9=&GFUL~;%qz@C61=Xr&EEYSuNHExWW6!+Maoto`=boRI%;p=z{NH
z-9v2<aDM;{C->^zsWJl4EYM260+?!@H$74R@{KG^n<{HlPeuExn?r;HQi(^UV+blR
zB7g+7=x~4r@HU_srRh(>GRV4hdPppU4{%dD$il1V??*5TMpIxJ^hLEWG0X9XJ#;Vy
ze+v2=$?<KgYmzE5Aoce{;=m!G<4&x}54vD7g<r>Np{C0w(`c^$o4it4$btYm{$~#l
zMOL0EKwiPf(zmV*nwWwo31C@+jRSKd7gmr{z_h)gMXG@-xtANfOJu*!7#qk_;^>Qj
zz@HFvyj<Vo*TYFCFZXx%N~WtvhKHYAy9d4$xRiW>U9Jyq6JlkW0!tUxIQz3iOHZMa
zU{68!F*zmX3`eyu4m=W0yeE)3RA3YfZIW>1&I^ZK+v=N%^bLQyjPo~vs8BOSEO!Iw
zgKxxanp|WVbTBQ;$amX(kWMBAXpp~_CCQ#*uOKo>K9}GjM{|H<+<S^fvG9v?m+Ax?
zi*R~JlH5eka2u3a%gbA`1<UjjJuZ;u9w-be4o8dt0xDhV{zQy}8XLG&`J+NfTLwWY
z#OXk=ZJ1Lcq4NEwinjN*W0kojSTI8DZ-{QdZbCdQ*A#%j!bPeJUdasw8FJ&o*AEL_
z{<oiw0kU7W3;3y&>_JQWC37F3nKZKpQ-Q1y&HI7<smLyt)TE}WI`8d&gEf%rzJP|O
z1VrH+V*=7D7S#mz3s@3UZckn`^BC$Ml+^ubUI1qyt*C5@$FJBxib0>=J+F||r-Fn`
z;YtIFjz^dV6Z%Hyq=xzXig%N;t?$d<d2ThMU?KR2P8;?@=q>4^ZhKz@F_{rL9e*Oo
zqB5%!$g(DpQ0&c(6CqZMG-bAPR4jlRKfaPgjFlCG6@K~nauNiQ0*XF_4_D}$f3u_T
z_Cv{rriWY?tuzqKJf`C86v{mez=NGJ61Jn<fG7mLA3yo)aNxhxG6Zf0q67Hy1YzxN
z@ACNd2t}xhGpYzP4{Ul95z~^pxnRo#)9a&XdN4R+MW=zfl8}9snU72k!&3508Dn2e
zw&i^F;*=cXBP-ytz*$+&*TAnOE3ktW)R$I~+V`>P18{y~26Ohz6Tn`bfBLH+A&d0X
zy`9|=M?I`Z^K(+?$Y6}^ls*rbmMk*BkcH{+(D3<vCxDm86IHDk{wX}QfgkC?5OnXF
z!D%dVSuN;t$ZosN<~Cxp0jU@Fa)ql51*3@=S!3_;1{{yV(%RM1AzEq3r?@&YIH6~|
z#`xufJiOn;e5In+U&l&rqHD%Y0TAu13kedla@rtvK&CY^sR$)km6aM0r2wqh4RT}d
z0%`&oqZHVO;8nr)11%-BEXnsWlINZso{D133Sk9$Tq1!%a|I*Wk;&jN5Em!A@gOuI
zd+adltbnveTKbB|++~N!aPNl^iC`{>u-27UdH->YKU+nWH1WdX+Z~x<@mM^HN3;-p
zd;NYC%LEBz7+KI`=bucQDr=>NThd|e{?O^CX@Nynvf2dUzssim?~2D!>*2v6AXUKZ
zY?!kfQ=Ba=)jg?U(OT0uo>>k<5M+&ng=_&+W|si&#mSFpNvn8drMLnND?XoJ);P~K
zn;<ObhX1g=p#_2v?h@VEE~><=8&kh9Arn_;>_Lj|JakyUTbAR(av%`MCVE^@zz7t?
zXL40_sdIp!1&=S^A-mDECrFM8S+Jr%%P}SL?yG`RgM9-;SV4YI8`|I*VOcEgls;bp
zSQFgBWDNp}uc)Tywbks+(^8@Z80;U2cMSzjHamHhZ0Dovv;8>WI4;ROG7`x-iRJBN
zrp(pYjz8=f9vGqvYsel4S<v7C+<8-{?v5^^_2_DCKVxhI?o}{H0L3+rvrwb_@pF>r
zNk4ndZmls@E_Atp?HZ%{msRu#)|W4?oA%3ub#%t$Rem68bh@^r((ylgP)9dsL=`(Z
z3pF8rA;Aj4x67ve)OkYDD#N_kG+M9@^!D4YGp5e2LN}%bUn3>kOVjf>^VNx?b#vte
z4TF%9G~EWI1PmSOCuBa3@VlLNyf4y%6^N(pS|cjP%4DDTaqqJm_em7uen=cuVr>?m
z;7B0U#tArfwAD2Q>GS#2Q#4lSN0@ogg0(m`$9A<LwLNnC`9S%jqH#1}c;pJlmy7zV
zxrHg#V9WXHL|1`L)Ck+}Y_meP)}p@+U|G|GH77b1Oa^s3Jbyn@O9}*rhLI_|XtHuH
z!U{ATAEXjbI2;@TG9dg;&H%oz`f*yYg7Fps_mpKHQKj%zHz(z909NOp_93*4sXynC
z1s@CSH7_om1jTi`Ga~u0n$v<c+3yNadWsA2QOR$uX&?<H2$r$u7GouzK)2J*#*(18
z<#JxAJXj+|a$wa9U~whl=pn2iz+A)>B?H=$i9QI6gb>6l2UdSMu)-OrCks~goFlDc
zu=+<z!YWc4tbSMIN-F|uH5pc(>KumET16){P(oT=!^G2YCJ$>$Kosh-s9^Qi<}|;l
zBf)CFW*0)9=OCuY${Q8!?5JcC6gM10lm=^7cmf5%!g5z$f0*GDt#Bp)F$ppceU1{W
z#ag9lPe}nzjNp`wY?p;i%%TfxK|-czwGo9b!{yw6J^c3BOVU_HsHqbd9Sxq7urAbW
z8E@A5x_cvzdI(lfPLX2j`)OLxg0=EViQO6_YRPxmWLlD%LrS)SfwxA7u;wDN5DpBY
zGoA3Gv$^e`J@#@R2fjlK*0%a4`*piy=dh8_9eyx*c=0w#W%6%jSkA#z3p%*X@=-sI
zr&{ni_`Vv)`La_j@R-1AV}++_!8-E!v;8^~>I{}}g#pMWDT4)KE}s8C*DL^pSh2Qe
zNXzfwaoo2Yq+Txz4lN_}CfzhPm|<DOUVz50U_&pOc@7T_5|M4KZt&UuH@?nc&YVoP
z<pPbu#4OT8?VRY;6aV>>I-PI3#;7bapDwJCR(?n%x|~fh?J~%KPvTeuy?vLCdt1-7
zBo+t|XlHG41u2ak52SU4{3*SkK76DLYev{Dq%a62$8!8(&-0|mq|t0Jxcp^$a|>3`
zypTQiqy_hVT|J@uosl7A8Lk48Vz<o)6d2Ghe_SMYl>%phMza4E($8yOR61?gi<cLe
z1BMk0nu^ZdpqQaigN7kc_2h-;??(lc<D?K$UOMijz{qP$b%X2X1AN(|<X9&Mo7jGM
z_kP?Oy^o)wto?uk&XsurnA+78z9w0K%+Om@%O$Y2FRHAEmu@QnD^QJK6A@Qcmuhk|
z>h$p<U1Ng_DcLsY+ATU|CuTzw5M}L;%>l-d{n+#&?2s!qTT<2|z~e(KTAlxj?qnhC
zOUWlM^JR~ck5;hIzHS%X+tp3{VQ**m6$@W%0fu0?zRm2N+J?4mg+a;P9MZE_<P?hw
zqseGLwoL1!hIv<OhhkIP-aLCLki8sDJglwC0-KG^xFa6VlOCPeuy<C?!<IS`le0)O
zh98KpF~pr!oMQ;Z#9k~A0B;t}^;c|uD>`j>2q_P^j71$6084%F&kbx{IDSAwFIjk#
zYTV8$qKY{ja7tCVC8T-e?_a-j*|?v=>x%sqlMPf?;c3GVa-;=c<4`&u0qVH?G&voO
zt)#}iepu-C^MTnZu;N9V-x(yhhmn>94h;;Z21ZlNcfy~@{(F-l5GI8txnl=_#Y5Ml
zOD7ql-EJ{&dv0{9<kF!8w+qnp**19?$0d+uExF<e0!6Q_N9C?U0cpGK8IBb;Q5e?#
zp1y0s(-Z<bI?as@T$Q-S9eeF=?>zU{3FsK%irIoJ-Uf&7cNeGRNUnGSQ9!aq)X$5~
zm1?T0o5<o!>{jKEiiF?oq*z3ZerN!uApEeKB%Nq^+i;4_<1NvlUM@dv%iXZ|z*2C&
zNtA<^>3MuLs`^u6QC*;MO&CO7Z(GhP!p`Ql3y0jqY)LjT#!^-fFD6R%|GVM}w=D<c
zRzsMM`mN~Q&F5`TJrym9X;*Wb=WmB8miA&sPk>G<s>~^w;Nnc|W?(*YVp43^7*oyg
z8nx~ozaFkDeM4&Q=P#ejvhp3iAFDGl{oszR(_W-`%jG<=7!NK4NOnn{gB75h3<6eJ
zbX9>e4NaA`XN+v9nHK)9&;!my8aP@kY52vxT(_SO@|NgMtf;F}Fa_5Nm||7;NGg>b
zm2AJ>1g{(+3sazsV3hOYGv!uuqgAUVGc?}jI~vAue0rOdzI^+v)JNT%Sea!?129sm
z$a=9>ihtx_U%%wa{;H=h+<%r+gaT_Vgg;>iT(Dv()CDkTRlfk4KWkzuCp5q-125Ol
z47)`t!G`Czg7o>~MKDuIX-RcOK*SzKBuXuE0!|f}7E(WAxtx{#fV=%Vlf3KcN+>Ea
zuB_0Hd*zfjT8_<sXMsZH-^v(gVMoCQVhAyx(|`Bzu%YiMs6$R%Bq&<BGk|6FJo%AS
zOk3YIhU~FN7$l`>Lg%w1uaTC%q<B&Zb+E46o#o3b*CNgtF4b}U-~OUIkE9k$8tfZ*
zcH{mTV-ar|i?>vn#f1npBH31pG{J>}MQR#NS&&4mwWcw`%)?qm2eqeiL>0c^v*UO}
zS+&wC3ym$he*eK&{WwovmH?lC=d@v8c4U&QGE`up(nGGF)G)XBX2)0w+sUnEM>ZTm
zw{3vv4s@dY@pHT~3rT5OsvAP~*a4>Uy+8Ud(W;%fF?TUyqts$}SS~d=8;K5>Y&ysS
zShlN;AjBpv+b37Td-XOwIM#dHF;G~piVn7ohTIbElEuaWO$bT2D%uX~O|Dq_mZawN
zed?9fqu`?g^sFrxXdpsLqiP$d)TO_@h_!Q+Tw`!#WCZ-F#kV`;78%2rZwXiKjI#1?
zt8F6Jza&iKZhl+;G&b$Bg%7B$<+ticoovE#+i^wl$7?H6!%;;C0J2?UbauDh-BZ!k
z`LB9L>rzN96PXj041Rxfc$iJ21`P{Z)zQ#8C8Znjiw^Ym$M6F=3pMCh!vz8N)3PkN
zn@dq;bYy54+oGr}s~|Nn>WrZcxDm_w8UQg;7ZW6ra9XKofu=(c>9y4i8uRStgWBQ>
zpesWIgOc4gRvNvfEz;W04&|qE>zv>=n!7~1{?!|~6`CehzZGjDJV20vc$omb`mJni
zh$7K5T(Y18Nv5!BxS(<1b32<pls_)YiB3rkh)VU3Obv)k@sG*~y$Q~+vHTslKBPYG
z$OwtXNwqewGV(#_Kzq=7e)@E(`GPqzpSPndGk*f5oF`av{N3|%_g@a-OqLF~SUxRi
zr=TLcsIR;Cvy2MP6DUMYQOX(Q7d$?6Czf`?6`zhMfT6e_5=UJ@NNKR*UH3dW+j*m@
zxUEdO{u)#m+zWUWkOE|1Fs1GrIBuZ7ySMRm4LD4%tw+&ZAFb$vSS~ltA%qm^POY@!
zx5>M4A7TW)svgZ2<HHp|DuE=N+voV?+C6yq36~s~`pvG^_R5@M2>)F-AAp#ZSa*{?
zrjb@BvCWAlw(S#Rl5&w3mk#`tr$)Ed1#yoWh#J5h`Kp^I`CbM}1WcBq1d`kXtoGad
zS6LAW$W{oT7Ao3&!j2A#VhaB4%OtkaVoYA+3KBA1HktBNS#*OXV!=`-LXxZ&Ydik<
zXYejtaO>caO7G_Zp9Pfrx_V@lpB(J#2OHAzrv6P{Y2Nj;M30EDgD${-!Q4Yvjjh^e
z((Y{3jsdZ|?ht~@>4d>yOx~8kD?A&RFssE{3g!KXC7ZF0NO;Ti?AMz>;On#P*cl^X
z#8LNXUO=2<NW5zpgrRW8yN2F!K7Z9F=(4%bxxJ2l+Lqwooi^+R4u@H7`rAuL$sB&W
z<9^6>ERLA5t#U}nLTG#5^aN*trj2+XHMXMQ603ZOt9h(20KCR_%|*_g@Cn4G*x(~B
zkEAOodTWqz&LYj1_wz8nKlyF+l(t_MyaJyGIl_wfP9R+^kg#!dP8$WchL!9~&=Mev
z^)KI$@&+>uD-m4ai4P+Zp_LO*#u+FthRzm%c)zWo`HNByWp43^cXHi}s<4Bups<SW
zN;ZA-1k{khKCf+Nk0X<$ZiX_8U>z6U3=XCR$NHeInXsGI43@<m+oTJr;kVZKiiNM_
zo(QuPR+4S1DJTO!?)lph#LF+$oqn@G0u;g!U>c$Oou9<s6W6-<JS98mPVHvTn6<5X
z`r?lFMX%qFTFl!qZisLiZ763U64zZk=K1W#gZ8@SDH77@fR)&82!R^P-e!c}a@n}w
z^4lG}rL3`iGL^WUgT!{FU_-4IYC>Pe@B+#o72#QksotG@`gVNB)@<~2bmhgS`|S7|
zOG5L|y_!hj<AiJ4jZIx&riUfM9oC!NbUN2qUNg|sr`)v848tlV^@rqBM`}wdlYB0n
zF%+Ko@lRyywb9A2!sP~I+Zr<E?8re}gM#p7HKd><#16jd$0IF$3llOyOGq_=rvcMx
zf|UYj2<;oostXgdZaADhscGr({chVeMxs@Ql0nqC5MXqg0R$bwl?Grm?bhyc-e?+O
z=8+W^U-jfg*Jw%EX~S_=z)F#YsxBzYiAuTUbPoKrpO&Ssy1CTzq`EmsdNkJ`Xk1BZ
z4mQ>_dybihRq4_+BjP!$rS)HPe1-KZtY2aM3hUQH`N#hOFyplijo(>S00000NkvXX
Hu0mjfp5oit

literal 0
HcmV?d00001

diff --git a/favicon.ico b/favicon.ico
new file mode 100644
index 0000000000000000000000000000000000000000..5910affa267d71a89e2a24b9b26cfaaf2b57890a
GIT binary patch
literal 1150
zcmb7EOGuPa6h4wP%Urq5RYc^YLWrPMK`m5VsEI{HWLZHEqZ%ERQBl+J(a?kqnhzXI
z(ZVPsGh!BnE^?uWgXm2C{NrO7#cJb>I2`YH<-*U;Xmp1&_ug~9@7(j^CrS{%q$Cpm
zDO8e3luSfNg$R|<?CQlvBy8rz%w!b*TrlI6eb{~XVxvFr_!EZU4Bg_ae$t3Fo+F!4
z3owea*Y2_nb^~kVMx$E?ZI@qu2d6Njj6H3myfCA2Y&#}k%>G%O2V7%Zbjl{<DKBzO
z7=5UB?`1hyn_uRiz92W;?&51_?0off71!PDl>U|iAui2rl|B%Ma81a!Ak`WJF1)<K
zqn>YEkY<$_V-C>0>-fs+tAC_l*yg9TOn3F$cASUZUu2w!-^eqce|YD3q{}NYPV1XK
zRp*etE@L+1&3ELr5&kRrx6ak+m(t6&@FrHt`TBj|hOg^qt0fk-1Q&wbQ0xEY!{7bv
zW*>Icz3q|bpYJ1n)EOM)-s|}2z#0A37guHfao<aPQvq3P*wI66VdWV5cO|oeSF|<$
zJUAKG2Wo`g;%&?YIOx472EDEyal+r73(uqv<kDU_BxmJ8PBXu-4#@n##T{789Jmn7
zZ*6hs81#q(^NU$i3%%`kev-2YOwEmsac~r0?eDw24+~F}M}UbZumPj+@%CUKbfl;0
tL(Aj*=TrHqPh$|Ap@YrLi5w>SWg+q&AhIXyiuoI%?#d4A??Xi3?f}f{g_-~W

literal 0
HcmV?d00001

diff --git a/index.html b/index.html
new file mode 100644
index 0000000..d23756a
--- /dev/null
+++ b/index.html
@@ -0,0 +1,528 @@
+<!doctype html>
+<html manifest="/canonicalauth/canauth.appcache">
+<head>
+<meta charset=utf8>
+<title>Canonical auth</title>
+<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
+<meta name="apple-mobile-web-app-capable" content="yes">
+<link rel="apple-touch-icon" href="canonical_aubergine_hex_crushed.png" sizes="114x114">
+<link rel="shortcut icon" href="http://design.canonical.com/wp-content/themes/canonical-design/favicon.ico" />
+<script>
+/*
+ * A JavaScript implementation of the Secure Hash Algorithm, SHA-1, as defined
+ * in FIPS 180-1
+ * Version 2.2 Copyright Paul Johnston 2000 - 2009.
+ * Other contributors: Greg Holt, Andrew Kepert, Ydnar, Lostinet
+ * Distributed under the BSD License
+ * See http://pajhome.org.uk/crypt/md5 for details.
+ */
+
+/*
+ * Configurable variables. You may need to tweak these to be compatible with
+ * the server-side, but the defaults work in most cases.
+ */
+var hexcase = 0;  /* hex output format. 0 - lowercase; 1 - uppercase        */
+var b64pad  = ""; /* base-64 pad character. "=" for strict RFC compliance   */
+
+/*
+ * These are the functions you'll usually want to call
+ * They take string arguments and return either hex or base-64 encoded strings
+ */
+function hex_sha1(s)    { return rstr2hex(rstr_sha1(str2rstr_utf8(s))); }
+function b64_sha1(s)    { return rstr2b64(rstr_sha1(str2rstr_utf8(s))); }
+function any_sha1(s, e) { return rstr2any(rstr_sha1(str2rstr_utf8(s)), e); }
+function hex_hmac_sha1(k, d)
+  { return rstr2hex(rstr_hmac_sha1(str2rstr_utf8(k), str2rstr_utf8(d))); }
+function b64_hmac_sha1(k, d)
+  { return rstr2b64(rstr_hmac_sha1(str2rstr_utf8(k), str2rstr_utf8(d))); }
+function any_hmac_sha1(k, d, e)
+  { return rstr2any(rstr_hmac_sha1(str2rstr_utf8(k), str2rstr_utf8(d)), e); }
+
+/*
+ * Perform a simple self-test to see if the VM is working
+ */
+function sha1_vm_test()
+{
+  return hex_sha1("abc").toLowerCase() == "a9993e364706816aba3e25717850c26c9cd0d89d";
+}
+
+/*
+ * Calculate the SHA1 of a raw string
+ */
+function rstr_sha1(s)
+{
+  return binb2rstr(binb_sha1(rstr2binb(s), s.length * 8));
+}
+
+/*
+ * Calculate the HMAC-SHA1 of a key and some data (raw strings)
+ */
+function rstr_hmac_sha1(key, data)
+{
+  var bkey = rstr2binb(key);
+  if(bkey.length > 16) bkey = binb_sha1(bkey, key.length * 8);
+
+  var ipad = Array(16), opad = Array(16);
+  for(var i = 0; i < 16; i++)
+  {
+    ipad[i] = bkey[i] ^ 0x36363636;
+    opad[i] = bkey[i] ^ 0x5C5C5C5C;
+  }
+
+  var hash = binb_sha1(ipad.concat(rstr2binb(data)), 512 + data.length * 8);
+  return binb2rstr(binb_sha1(opad.concat(hash), 512 + 160));
+}
+
+/*
+ * Convert a raw string to a hex string
+ */
+function rstr2hex(input)
+{
+  try { hexcase } catch(e) { hexcase=0; }
+  var hex_tab = hexcase ? "0123456789ABCDEF" : "0123456789abcdef";
+  var output = "";
+  var x;
+  for(var i = 0; i < input.length; i++)
+  {
+    x = input.charCodeAt(i);
+    output += hex_tab.charAt((x >>> 4) & 0x0F)
+           +  hex_tab.charAt( x        & 0x0F);
+  }
+  return output;
+}
+
+/*
+ * Convert a raw string to a base-64 string
+ */
+function rstr2b64(input)
+{
+  try { b64pad } catch(e) { b64pad=''; }
+  var tab = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+  var output = "";
+  var len = input.length;
+  for(var i = 0; i < len; i += 3)
+  {
+    var triplet = (input.charCodeAt(i) << 16)
+                | (i + 1 < len ? input.charCodeAt(i+1) << 8 : 0)
+                | (i + 2 < len ? input.charCodeAt(i+2)      : 0);
+    for(var j = 0; j < 4; j++)
+    {
+      if(i * 8 + j * 6 > input.length * 8) output += b64pad;
+      else output += tab.charAt((triplet >>> 6*(3-j)) & 0x3F);
+    }
+  }
+  return output;
+}
+
+/*
+ * Convert a raw string to an arbitrary string encoding
+ */
+function rstr2any(input, encoding)
+{
+  var divisor = encoding.length;
+  var remainders = Array();
+  var i, q, x, quotient;
+
+  /* Convert to an array of 16-bit big-endian values, forming the dividend */
+  var dividend = Array(Math.ceil(input.length / 2));
+  for(i = 0; i < dividend.length; i++)
+  {
+    dividend[i] = (input.charCodeAt(i * 2) << 8) | input.charCodeAt(i * 2 + 1);
+  }
+
+  /*
+   * Repeatedly perform a long division. The binary array forms the dividend,
+   * the length of the encoding is the divisor. Once computed, the quotient
+   * forms the dividend for the next step. We stop when the dividend is zero.
+   * All remainders are stored for later use.
+   */
+  while(dividend.length > 0)
+  {
+    quotient = Array();
+    x = 0;
+    for(i = 0; i < dividend.length; i++)
+    {
+      x = (x << 16) + dividend[i];
+      q = Math.floor(x / divisor);
+      x -= q * divisor;
+      if(quotient.length > 0 || q > 0)
+        quotient[quotient.length] = q;
+    }
+    remainders[remainders.length] = x;
+    dividend = quotient;
+  }
+
+  /* Convert the remainders to the output string */
+  var output = "";
+  for(i = remainders.length - 1; i >= 0; i--)
+    output += encoding.charAt(remainders[i]);
+
+  /* Append leading zero equivalents */
+  var full_length = Math.ceil(input.length * 8 /
+                                    (Math.log(encoding.length) / Math.log(2)))
+  for(i = output.length; i < full_length; i++)
+    output = encoding[0] + output;
+
+  return output;
+}
+
+/*
+ * Encode a string as utf-8.
+ * For efficiency, this assumes the input is valid utf-16.
+ */
+function str2rstr_utf8(input)
+{
+  var output = "";
+  var i = -1;
+  var x, y;
+
+  while(++i < input.length)
+  {
+    /* Decode utf-16 surrogate pairs */
+    x = input.charCodeAt(i);
+    y = i + 1 < input.length ? input.charCodeAt(i + 1) : 0;
+    if(0xD800 <= x && x <= 0xDBFF && 0xDC00 <= y && y <= 0xDFFF)
+    {
+      x = 0x10000 + ((x & 0x03FF) << 10) + (y & 0x03FF);
+      i++;
+    }
+
+    /* Encode output as utf-8 */
+    if(x <= 0x7F)
+      output += String.fromCharCode(x);
+    else if(x <= 0x7FF)
+      output += String.fromCharCode(0xC0 | ((x >>> 6 ) & 0x1F),
+                                    0x80 | ( x         & 0x3F));
+    else if(x <= 0xFFFF)
+      output += String.fromCharCode(0xE0 | ((x >>> 12) & 0x0F),
+                                    0x80 | ((x >>> 6 ) & 0x3F),
+                                    0x80 | ( x         & 0x3F));
+    else if(x <= 0x1FFFFF)
+      output += String.fromCharCode(0xF0 | ((x >>> 18) & 0x07),
+                                    0x80 | ((x >>> 12) & 0x3F),
+                                    0x80 | ((x >>> 6 ) & 0x3F),
+                                    0x80 | ( x         & 0x3F));
+  }
+  return output;
+}
+
+/*
+ * Encode a string as utf-16
+ */
+function str2rstr_utf16le(input)
+{
+  var output = "";
+  for(var i = 0; i < input.length; i++)
+    output += String.fromCharCode( input.charCodeAt(i)        & 0xFF,
+                                  (input.charCodeAt(i) >>> 8) & 0xFF);
+  return output;
+}
+
+function str2rstr_utf16be(input)
+{
+  var output = "";
+  for(var i = 0; i < input.length; i++)
+    output += String.fromCharCode((input.charCodeAt(i) >>> 8) & 0xFF,
+                                   input.charCodeAt(i)        & 0xFF);
+  return output;
+}
+
+/*
+ * Convert a raw string to an array of big-endian words
+ * Characters >255 have their high-byte silently ignored.
+ */
+function rstr2binb(input)
+{
+  var output = Array(input.length >> 2);
+  for(var i = 0; i < output.length; i++)
+    output[i] = 0;
+  for(var i = 0; i < input.length * 8; i += 8)
+    output[i>>5] |= (input.charCodeAt(i / 8) & 0xFF) << (24 - i % 32);
+  return output;
+}
+
+/*
+ * Convert an array of big-endian words to a string
+ */
+function binb2rstr(input)
+{
+  var output = "";
+  for(var i = 0; i < input.length * 32; i += 8)
+    output += String.fromCharCode((input[i>>5] >>> (24 - i % 32)) & 0xFF);
+  return output;
+}
+
+/*
+ * Calculate the SHA-1 of an array of big-endian words, and a bit length
+ */
+function binb_sha1(x, len)
+{
+  /* append padding */
+  x[len >> 5] |= 0x80 << (24 - len % 32);
+  x[((len + 64 >> 9) << 4) + 15] = len;
+
+  var w = Array(80);
+  var a =  1732584193;
+  var b = -271733879;
+  var c = -1732584194;
+  var d =  271733878;
+  var e = -1009589776;
+
+  for(var i = 0; i < x.length; i += 16)
+  {
+    var olda = a;
+    var oldb = b;
+    var oldc = c;
+    var oldd = d;
+    var olde = e;
+
+    for(var j = 0; j < 80; j++)
+    {
+      if(j < 16) w[j] = x[i + j];
+      else w[j] = bit_rol(w[j-3] ^ w[j-8] ^ w[j-14] ^ w[j-16], 1);
+      var t = safe_add(safe_add(bit_rol(a, 5), sha1_ft(j, b, c, d)),
+                       safe_add(safe_add(e, w[j]), sha1_kt(j)));
+      e = d;
+      d = c;
+      c = bit_rol(b, 30);
+      b = a;
+      a = t;
+    }
+
+    a = safe_add(a, olda);
+    b = safe_add(b, oldb);
+    c = safe_add(c, oldc);
+    d = safe_add(d, oldd);
+    e = safe_add(e, olde);
+  }
+  return Array(a, b, c, d, e);
+
+}
+
+/*
+ * Perform the appropriate triplet combination function for the current
+ * iteration
+ */
+function sha1_ft(t, b, c, d)
+{
+  if(t < 20) return (b & c) | ((~b) & d);
+  if(t < 40) return b ^ c ^ d;
+  if(t < 60) return (b & c) | (b & d) | (c & d);
+  return b ^ c ^ d;
+}
+
+/*
+ * Determine the appropriate additive constant for the current iteration
+ */
+function sha1_kt(t)
+{
+  return (t < 20) ?  1518500249 : (t < 40) ?  1859775393 :
+         (t < 60) ? -1894007588 : -899497514;
+}
+
+/*
+ * Add integers, wrapping at 2^32. This uses 16-bit operations internally
+ * to work around bugs in some JS interpreters.
+ */
+function safe_add(x, y)
+{
+  var lsw = (x & 0xFFFF) + (y & 0xFFFF);
+  var msw = (x >> 16) + (y >> 16) + (lsw >> 16);
+  return (msw << 16) | (lsw & 0xFFFF);
+}
+
+/*
+ * Bitwise rotate a 32-bit number to the left.
+ */
+function bit_rol(num, cnt)
+{
+  return (num << cnt) | (num >>> (32 - cnt));
+}
+</script>
+<script>
+function truncatedvalue(h, p) {
+    /* this function from http://www.gitorious.org/hotp-js */
+    // h is the hash value
+    // p is precision
+    offset = h[19] & 0xf;
+    v = (h[offset] & 0x7f) << 24 | (h[offset + 1] & 0xff) << 16 | (h[offset + 2] & 0xff) << 8 | (h[offset + 3] & 0xff);
+    v = "" + v;
+    v = v.substr(v.length - p, p);
+    return v;
+}
+
+function hexToBytes(hex) {
+    /* this function from http://code.google.com/p/crypto-js/source/browse/branches/2.x/src/Crypto.js */
+    for (var bytes = [], c = 0; c < hex.length; c += 2) {
+        bytes.push(parseInt(hex.substr(c, 2), 16));
+    }
+    return bytes;
+}
+
+
+function ctransform(c) {
+    // transform to a 16-digit hex number
+    var hexval = "0000000000000000" + c.toString(16);
+    hexval = hexval.substr(hexval.length-16);
+    var bytestream = ktransform(hexval);
+    return bytestream;
+}
+function ktransform(k) {
+    var bytestream = [];
+    for (var i=0; i<k.length; i+=2) {
+        bytestream.push(String.fromCharCode(parseInt(k.substr(i,2), 16)));
+    }
+    return bytestream.join("");
+}
+
+function hotp(key,counter) {
+    var hmacBytes = rstr2hex(rstr_hmac_sha1(ktransform(key), ctransform(counter)));
+    return truncatedvalue(hexToBytes(hmacBytes), 6); // dec6 format which is what Canonical uses
+}
+</script>
+
+<style>
+html, body {
+    margin: 0;
+    padding: 0;
+}
+body {
+    font-family: Ubuntu, sans-serif;
+    color: black;
+    background: white;
+}
+h1 {
+    font-size: 150%;
+    background: #772953;
+    color: white;
+}
+h1, h2, p, input {
+    text-align: center;
+}
+.instr {
+    margin: auto 1em;
+    color: #666;
+}
+input, button {
+    width: 90%;
+    min-height: 44px;
+}
+#debug a {
+    position: absolute;
+    bottom: 0;
+    right: 0;
+    text-align: right;
+    text-decoration: none;
+    background: #dfdcd9;
+    color: white;
+    padding: 8px;
+    margin: 0;
+    border-radius: 6px 0 0 0;
+}
+#otp {
+    font-size: 3em;
+}
+</style>
+
+</head>
+<body>
+<h1>Canonical 2-factor-auth</h1>
+<div id="addkey">
+<h2>Add your key</h2>
+<p class="instr">Sign into Ubuntu single-sign-on (<strong>login.ubuntu.com</strong>).
+Choose <strong>Authentication&nbsp;devices</strong> &gt;
+<strong>Add&nbsp;a&nbsp;new&nbsp;authentication&nbsp;device</strong> &gt;
+<strong>Generic&nbsp;HOTP&nbsp;device</strong> &gt;
+<strong>Add&nbsp;device</strong>. Enter the "Shared AES key" below.</p>
+<p class="instr">(Lowercase is fine)</p>
+<p><input id="keydata" type="text" maxlength="49"></p>
+<p><button id="savekey">Generate one-time password</button></p>
+</div>
+<div id="auth">
+<p>Your one-time password</p>
+<p id="otp"></p>
+<p><button id="refresh">Refresh</button></p>
+<p id="debug"><a href="#">debug</a></p>
+</div>
+<div id="debugd">
+<p>Your key (last four characters): <span id="lastfour">????</span></p>
+<p>Your key counter: <span id="counterdisplay">?</span></p>
+<p><button id="resetcounter">Reset counter to 0</button></p>
+<p><button id="deletekey">Delete key and counter</button></p>
+<p><button id="back">Back</button></p>
+</div>
+<script>
+var key = localStorage.getItem("canonical-otp-key");
+var counter = localStorage.getItem("canonical-otp-counter");
+if (key) {
+    document.getElementById("addkey").style.display = "none";
+    document.getElementById("debugd").style.display = "none";
+    document.getElementById("auth").style.display = "block";
+    document.getElementById("otp").innerHTML = hotp(key, parseInt(counter, 10));
+} else {
+    document.getElementById("addkey").style.display = "block";
+    document.getElementById("auth").style.display = "none";
+    document.getElementById("debugd").style.display = "none";
+}
+document.getElementById("savekey").onclick = function() {
+    var keyval = document.getElementById("keydata").value.replace(/\s/g, '').toLowerCase();
+    if (keyval.match(/^[0-9a-f]{40}$/i) === null) {
+        alert('Your "shared AES key" should be 40 characters long, and composed of numbers 0-9 and letters a-f.');
+        document.getElementById("keydata").focus();
+        document.getElementById("keydata").select();
+        return;
+    }
+    localStorage.setItem("canonical-otp-counter", 0);
+    localStorage.setItem("canonical-otp-key", keyval);
+    location.reload();
+}
+document.getElementById("refresh").onclick = function() {
+    counter = parseInt(counter, 10) + 1;
+    localStorage.setItem("canonical-otp-counter", counter);
+    location.reload();
+}
+document.getElementById("resetcounter").onclick = function() {
+    counter = 0;
+    localStorage.setItem("canonical-otp-counter", counter);
+    location.reload();
+}
+document.getElementById("deletekey").onclick = function() {
+    localStorage.removeItem("canonical-otp-counter");
+    localStorage.removeItem("canonical-otp-key");
+    location.reload();
+}
+document.getElementById("back").onclick = function() {
+    location.reload();
+}
+document.getElementById("debug").onclick = function(e) {
+    document.getElementById("addkey").style.display = "none";
+    document.getElementById("auth").style.display = "none";
+    document.getElementById("debugd").style.display = "block";
+    document.getElementById("lastfour").firstChild.nodeValue = key.substr(key.length - 4);
+    document.getElementById("counterdisplay").firstChild.nodeValue = counter.toString();
+    e.preventDefault();
+    return false;
+}
+
+// Check if a new cache is available on page load.
+if (window.addEventListener) {
+    window.addEventListener('load', function(e) {
+
+      window.applicationCache.addEventListener('updateready', function(e) {
+        if (window.applicationCache.status == window.applicationCache.UPDATEREADY) {
+          // Browser downloaded a new app cache.
+          // Swap it in and reload the page to get the new hotness.
+          window.applicationCache.swapCache();
+          if (confirm('A new version of this site is available. Load it?')) {
+            window.location.reload();
+          }
+        } else {
+          // Manifest didn't changed. Nothing new to server.
+        }
+      }, false);
+
+    }, false);
+}
+</script>
+</body>
+</html>