Repository: freedomofpress/securedrop

Issue:
Recommend a FOSS OTP tool
# Feature request

## Description
Google's authenticator is proprietary, and FreeOTP,  which is mentioned once in the UI, strings is no longer maintained, even though it could probably still be functional on current Androids.

Perhaps the **main recommendation** and in-line examples should be of FOSS OTP tools, such as [andOTP](https://github.com/andOTP/andOTP) or [FreeOTP](https://github.com/freeotp/freeotp-android), by using their names in the user's directions, with Google's as a secondary recommendation, if at all.

## User Stories
When advising users in similar situation, I recommend FOSS whenever possible. This is even more relevant in contexts of security and privacy.



Discussion:
FreeOTP still work as of Nougat, I see activity this month here: https://github.com/freeotp/freeotp-android/commits/master What exactly isn't maintained anymore? andOTP mentioned that they're doing this now as a side project. I like your suggestion.
> Google's authenticator is proprietary

I did not realize that. There is a Free Software [version of Google Authenticator](https://github.com/google/google-authenticator) but it explicitly says the Android app is **not** Free Software. Does anyone know more about that ?

If it is confirmed to be a proprietary blob I second your proposal.
> FreeOTP [...] is no longer maintained

@agharbeia Citation? I agree with @KwadroNaut: there's still activity on the GitHub repo. Have you seen an announcement by the maintainers that the project is deprecated?

Big fan of recommending FreeOTP. We're already doing that (see 476223f26 via #1746), but happy to give it priority. We apparently only recommend FreeOTP in comparatively few locations:

```
$ grep -riPo '(freeotp|google(\s+auth\w+))' docs | cut -d: -f2 | sort | uniq -c
      1 freeotp
      3 FreeOTP
     18 Google Authenticator
```

Would gladly review a PR that mentions FOSS alternatives first and Google Authenticator second. Unclear to me what FOSS alternatives should be for iOS users—both FreeOTP and andOTP mentioned above appear to be Android-only.
You are right, @KwadroNaut and @conorsch. it seems FreeOTP is still alive after all.
I should have rechecked before claiming that. The last time I had, a couple of months ago, it seemed to me to have been dormant for some time.
I have concerns. I definitely agree 100% that we should use FOSS in every case that we can. However, many large news organizations have security requirements that the organization requires a specific 2FA application (perhaps by Symantec or others). We should keep that in mind. 
Sure, some orgs mandate use of a specific 2FA application (e.g. Duo or Authy). As long as it's TOTP, it should work just fine. Worth pointing out that the TOTP use case is general and not specific to any one application over others.
Google Authenticator has permissions to access internet and camera [according to exodus](https://reports.exodus-privacy.eu.org/reports/537/). That plus the fact that it's proprietary does not look too good.
> I did not realize that. There is a Free Software version of Google Authenticator but it explicitly says the Android app is not Free Software. Does anyone know more about that ?

@dachary you're not linking to the google-authenticator-android project. It used to be open (Apache license), but like many pieces of Android that Google maintains and develops it is now only available under a closed license. See https://github.com/google/google-authenticator-android 

> This project is an older fork of the one on the Play store. It's an older version that doesn't get changes synced to it from the Play store version.

@b-meson there will always be a discrepancy between that what's suggested and that what's being used. There are some missing features/bugs with Duo and FreeOTP (ie, no u2f), but all the basic stuff (TOTP) works fine. @conorsch idea to point out that TOTP is the magic keyword here, regardless of app, is a good one.

@dachary permissions camera: scan a qr-code, internet: not sure.
> you're not linking to the google-authenticator-android project. 

Ah, right. So it's confirmed that Google Authenticator as found in the app store is indeed a proprietary blob ?

> permissions camera: scan a qr-code, internet: not sure.

Yes, indeed :-)

Resolving patch:
diff --git a/securedrop/manage.py b/securedrop/manage.py
--- a/securedrop/manage.py
+++ b/securedrop/manage.py
@@ -189,9 +189,8 @@ def _add_user(is_admin=False):
     else:
         print('User "{}" successfully added'.format(username))
         if not otp_secret:
-            # Print the QR code for FreeOTP/ Google Authenticator
-            print('\nScan the QR code below with FreeOTP or Google '
-                  'Authenticator:\n')
+            # Print the QR code for FreeOTP
+            print('\nScan the QR code below with FreeOTP:\n')
             uri = user.totp.provisioning_uri(username,
                                              issuer_name='SecureDrop')
             qr = qrcode.QRCode()


Test patch:
diff --git a/docs/test_the_installation.rst b/docs/test_the_installation.rst
--- a/docs/test_the_installation.rst
+++ b/docs/test_the_installation.rst
@@ -29,13 +29,13 @@ Log in to both servers via TTY
 All access to the SecureDrop servers should be performed over SSH from the
 *Admin Workstation*. To aid in troubleshooting, physical logins via TTY are
 supported, but require 2FA to be configured. See the :doc:`2FA setup guide
-<google_authenticator>` for information how to enable console logins.
+<servers_2fa>` for information how to enable console logins.
 
 Test the 2FA functionality by connecting a keyboard and display to each server,
 then login with the Admin username. You will need:
 
 * sudo passphrase for the Admin username
-* TOTP code from a 2FA app such as Google Authenticator or FreeOTP
+* TOTP code from a 2FA app such as FreeOTP
 
 Confirm that logging in via TTY prompts for a 2FA code, and that the code
 generated by your smartphone app permits logging in to an interactive shell.
diff --git a/securedrop/tests/functional/journalist_navigation_steps.py b/securedrop/tests/functional/journalist_navigation_steps.py
--- a/securedrop/tests/functional/journalist_navigation_steps.py
+++ b/securedrop/tests/functional/journalist_navigation_steps.py
@@ -159,9 +159,9 @@ def _admin_adds_a_user(self):
 
         if not hasattr(self, 'accept_languages'):
             # Clicking submit on the add user form should redirect to
-            # the Google Authenticator page
+            # the FreeOTP page
             h1s = self.driver.find_elements_by_tag_name('h1')
-            assert "Enable Google Authenticator" in [el.text for el in h1s]
+            assert "Enable FreeOTP" in [el.text for el in h1s]
 
         # Retrieve the saved user object from the db and keep it around for
         # further testing
diff --git a/securedrop/tests/test_journalist.py b/securedrop/tests/test_journalist.py
--- a/securedrop/tests/test_journalist.py
+++ b/securedrop/tests/test_journalist.py
@@ -532,7 +532,7 @@ def test_http_get_on_admin_new_user_two_factor_page(self):
         resp = self.client.get(url_for('admin.new_user_two_factor',
                                        uid=self.user.id))
         # any GET req should take a user to the admin.new_user_two_factor page
-        self.assertIn('Authenticator', resp.data)
+        self.assertIn('FreeOTP', resp.data)
 
     def test_http_get_on_admin_add_user_page(self):
         self._login_admin()