paragonie / multi_factor Goto Github PK

At the time of writing with some very brief tests with the plain text encoder, it appears that the google auth app doesn't like qr codes that lack a username.

            $output->writeln('FIDOU2F QR Code:');

            ob_start();
            (
                new GoogleAuth(
                    $two_factor_auth_secret,
                    TOTP::ObtainInstance(time(), 30)
                )
            )->makeQRCode(
                new Writer(new PlainTextRenderer()),
                'php://output'
            );

            $output->write(ob_get_clean());

p.s. going to make some qrcode-related changes shortly.

just wondering if this should be using HiddenString for "secrets" ?

initially asked in #12 by @pavarnos

Probably leverage the Twilio API?

The code for generating the qrcode message makes quick checks to see if a string is "falsy", presumably intending to check if it's empty.

This means that a $label or $issuer of '' is treated identically to '0' and ' '.

How is trailing whitespace meant to be handled in these uris- i.e. should it be simply checking '' !== $label, or trim them first?

It would be nice to use Duo Security as a provider.

https://duo.com/docs/authapi

GPG-Mailer might be a viable 2FA strategy for GnuPG users.

Presumably the keys are stored in Authy's backend.

Hi. Is this project still alive?

• There have been no changes for a few years...
• Bacon QR Code is now v2 https://github.com/Bacon/BaconQrCode
• it might benefit from integration with some of your other libraries eg paragonie/hidden-string for the secret

Assuming:

1. Open Whisper Systems is OK with this.
2. We can create/find a stable PHP implementation of the Signal Protocol.
3. People actually want this.
4. People will actually use this.
5. There's a sane way to access the GCM servers for Signal.

The licence.md contains MIT at the top, then GPL; I'm unfamiliar with this, is it dual licensed? Single licensed?