On Sat, 2014-11-29 at 01:11 -0500, Peter wrote:
Because my devotion to open source, I'm thrilled to have
recently
switched to FreeOTP from Google Authenticator.
Being truly open source, FreeOTP appears to be a far better
alternative than Google Authenticator. But I do have one concern: when
I generate a code (on Android 4.4.4.) it not only displays the code
but also copies it to the clipboard. Is it possible to turn off the
copying to clipboard functionality?
Not currently.
The reason I ask is that I recently read this article which I found
disturbing:
http://arstechnica.com/security/2014/11/using-a-password-manager-on-andro...
Hence, I'm being very careful with what I copy to my clipboard on my
phone and would love to disable that specific funtion on FreeOTP. Is
that possible?
Technically, yes. However, it is significantly mitigated.
First, when implementing copy-to-clipboard by default, I intentionally
removed any hint as to the contents of the data. Hence, copying the code
to the clipboard just appears as a random number. Only the length gives
any hint it is an OTP.
Second, the OTP code is only valid for a short duration. For TOTP codes,
this is usually 30 seconds. However, the time is usually even shorter
than that because the clipboard copying only occurs on user demand. This
indicates the user's intent to use the token code quickly. This reduces
the window to effectively ~15 seconds for both TOTP and HOTP.
Third, the OTP is useless without the password. This is the whole idea
of 2FA. Never, ever copy your password to the clipboard. And never use a
password manager that does (basically all of them).
Forth, a sniffer has no idea which token has been copied or what service
it applies to. Even with root permissions, there is no access to
determine where the code is pasted to. It is possible that this can be
determined by close examination of what other apps are copying to the
clipboard. But this is not a bug in FreeOTP.
Or, being new to the app, perhaps I'm doing something wrong and
there
is a way for me to view the code without copying it at all?
Not currently.
However, I would be willing to accept patches to disable the clipboard
copy feature under the following conditions:
1. Clipboard copy should be on and automatic by default.
2. Both Android and iOS should have the same behavior.
3. I think I would prefer a global setting rather than per-token.
Nathaniel