python-bna icon indicating copy to clipboard operation
python-bna copied to clipboard

Published 20 hours ago • verified publisher icon jleclanche

Invalid TOTP URL for QR code

Open reepy opened this issue 4 years ago • 4 comments

I was trying to get bna to generate a URL, to create a QR code so I could add it to AndOTP.

However, the QR code wouldn't scan. AndOTP ('Invalid QR code'), Authy ('Invalid format, token format not supported') or FreeOTP ('The token specified was invalid') could use the QR code because of a missing colon. Google Authenticator scans it without issue.

The spec doesn't specify the colon is required.

As soon as the colon is added it works. The colon is present in the example in README.md under 'Getting an OTPAuth URL'.

Steps to reproduce:

  1. Setup bna
  2. Run bna show-url
  3. You'll notice the code is missing the colon before the question mark. This means you can't import this URL into common TOTP apps.

For example: otpauth://totp/Blizzard:SERIAL?secret=SERCRET&issuer=Blizzard&digits=8 Should be: otpauth://totp/Blizzard:SERIAL:?secret=SERCRET&issuer=Blizzard&digits=8

You can verify this:

  1. Install a QR code generator pip3 install qrcode[pil]
  2. Run qr "PASTEURLHERE"
  3. Try and scan the QR code. You'll notice you get an error.
  4. Repeat step 2, but add the missing colon.
  5. Try and scan the QR code. You'll notice it works this time.

reepy avatar Apr 02 '20 09:04 reepy

No, it doesn't work. AndOTP still can't scan that QR code until you delete &digits=8 manually.

DLslime avatar Jun 10 '20 06:06 DLslime

Deleting the &digits=8 let me scan the code but then I was unable to use it (or modify it to generate more digits)

mprobson avatar Jun 15 '20 13:06 mprobson

AndOTP don't allow you to modify OTP's digits after you add it by scan the QR code. So anyway, it is definitely AndOTP's own defect. Other authentication Apps should be tested to see whether they also have the similar problem.

DLslime avatar Jun 15 '20 14:06 DLslime

I tried other TOTP apps and it's in the original report (without removing &digits=8):

  • AndOTP - 'Invalid QR code'
  • Authy - 'Invalid format, token format not supported'
  • FreeOTP - 'The token specified was invalid'.

I've just tried a few more:

So maybe the standard is unclear and some are OK with the colon and others aren't?

reepy avatar Jul 14 '20 10:07 reepy