yashsingh1/xdaforums huggingface dataset:
[Android Apps and Games] Danmann:
Tried your option too.

I did now 2 ways to update my Rom. The dirty way and the clean way.

Dirty flash with only wiping cache and dalvik. And clean flash with wiping everything except SD cards ( incl & ext).

I haven't any problems with the dirty way. I can use the app without any problems. I can use the backups as well.

The clean way is already known.

So, the pair key gets deleted in Android keystore if you do a clean flash. In the dirty way it stays there I guess. I haven't really a clue but I guess that's it :)

How we can save the pair key? Or is it completely wrong thinking?
[Android Apps and Games] flocke000:
That's extremely strange, the clean way should always work. The key in the keystore should always be re-created if you do a clean install. And if you only use the internal backups, not Titanium Backup or a similar app it should always work on a clean install.
[Android Apps and Games] Danmann:
Yeah, I absolutely don't know.

Now I tried just the Rom. Without flashing root, nanomod or whatever.

Then I installed fdroid and andotp with the same result. I can backup and restore new backups but not the old ones. Maybe I can put the details in the new backup but I have to try it with the computer it doesn't work on the phone.

Until then I went back to my old clean Rom without dirty flash.
[Android Apps and Games] Danmann:
Hi.

I really like your app but I wanna move on.

Is there a possibility to swap the accounts to another 2fa app?

Thanks
[Android Apps and Games] flocke000:
There is a Python script that can read a backup from andOTP (plain backup) and print QR codes from it you could scan with the new app. I never used it so far so I can't tell you any details but here is the link: https://github.com/puddly/android-otp-extractor
[Android Apps and Games] Danmann:
Thank you for the hint.

I or more puddly got it sorted.

I had to uncomment a line in the software ( extract_otp_tokens.py). Like ...

# subprocess.check_output(['adb', 'shell', 'su', '-c', "am start -n org.shadowice.flocke.andotp/.Activities.BackupActivity"])

If you get following printed out

otpauth://totp/

then you can use 2fa-qr if you have similar problems like me. I couldn't use the command....

extract_otp_tokens.py --show-qr

Nothing showed up on my browser even after the update of puddly.

Everything discussed here.

Thank you for your great app and thanks again for the hint.

Edit:

Nope! It doesn't work....

I thought i found a way but noooo.... same thing like here

Sorry.

But with this way we could change the app.

Another edit:

I just found your test versions. That's working. Thanks for that!

By the way I had the same problem like gabm from Github.

And my rom changed the possibilty to use the option "Encrypt phone".

Maybe there is the problem?!
[Android Apps and Games] u7Xz:
[MENTION=5837930]flocke000[/MENTION] can i request a thumbnail icon for Reddit please? Reddit just released 2FA. Source.
[Android Apps and Games] flocke000:
We just released a new version which includes an icon for Reddit ;)

It is already on Google Play and should hit F-Droid in a few days.
[Android Apps and Games] u7Xz:
I feel very shamed now lol. I follow the project from Github just missed it. I look it before i updated the app i can see it now. Thanks.
[Android Apps and Games] freskile:
Is it possible to add "Multi Device Synchronization" funtionality similar to Authy? I see there are some issues with this approach, but it is mentioned that "it is only vulnerable to attack if you keep multi-device mode enabled."

https://www.reddit.com/r/Bitcoin/comments/6f0hhb/coinbase_recommendation_migrate_from_authy_to/

---

"Multi device" is putting your account into a mode where you can add other decvices. If you turn it off, every device you've enabled is still enabled, you just can't add any more. If your device is lost, you're not locked out, just use another device that you've previously enabled.

Official recommendation is to enable it, add another device, and disable it

---

I coul not find this feature supported on an open souce OTP application, and it would great if you could integrate it into this app.
[Android Apps and Games] flocke000:
Sorry, but I have to say no to that request.

andOTP is supposed to be just a two-factor authentication app. Our goal is to keep it as simple as possible.

This feature is far to specific and would require a lot of work to implement.
[Android Apps and Games] freskile:
I understand multi-device synchronization is too much to ask. Maybe you can consider a simpler feature. My initial point was to provide a simple method to share keys between two devices. I use both my phone and tablet to generate OTPs: creating a backup file in my phone, and restoring it via the andOTP installed on my tablet. These steps can be integrated into the application.

- It could be similar to "Secure Wifi Transfer" functionality provided in OpenKeyChain application. As OpenKeyChain shares/imports the PGP keys via this connection, andOTP can share accounts database in a secure way.

- or a more direct approach could be creating the json backup file -plain text or encrypted- on the fly and converting the whole file content into a QR code, and then restoring the accounts via reading the QR code in the other device.
[Android Apps and Games] flocke000:
That sounds a lot simpler but I will still have to think about it as it will be a lot of work to implement.

I currently don't have to much time that I can spend on andOTP so it will take a while.
[Android Apps and Games] electrified:
Hi, I have a backup (*.json.aes) file that is PIN protected.

Now I wanted to import it to another phone and i get a "decryption of the backup failed" when I try to load the backup. Any suggestions? What am I doing wrong?
[Android Apps and Games] flocke000:
By "PIN protected" I assume you mean the authentication you set in andOTP.

That's not the protection for the backup. You need to set the same "Backup password" in the Settings on both phones.
[Android Apps and Games] electrified:
Thanks, I was using PIN instead of Password. You saved me :)
[Android Apps and Games] ShapeShifter499:
I'm trying to settle with a OTP 2FA app that's open source and isn't vulnerable to SMS attacks. It's between yours and this other guy's https://github.com/OneTimePass/OneTimePass Can you or someone make a case for you over the other guy's?
[Android Apps and Games] ShapeShifter499:
Also, which is more secure to use in your app, Android KeyStore or Passphrase/Pin?
[Android Apps and Games] flocke000:
If you don't mind entering a Password/PIN every time you open the app I would definitely go with Password/PIN. From an encryption point they are both the same (they just generate the encryption key in different ways). But KeyStore is known to have some weird behaviour on some devices (especially on Android updates) so Password/PIN should be more stable.
[Android Apps and Games] flocke000:
Release v0.5.0

I just pushed a new release to Google Play and uploaded the APKs to Github. As always, the F-Droid release will most likely take a couple of days.

Changelog

New feature: Intro screen when staring the app for the first time to setup encryption and authentication

New feature: Broadcast receivers to trigger backups from Tasker (PR #115)

New feature: Add support for using Android Backup (Issue #109, PR #111)

New feature: Optionally append date to backups (PR #124)

New feature: Check if entries are valid when entering manually (Issue #135, PR #136 by Björn Richter)

New feature: Offer different options when using the tag selection (Issue #133, PR #134)

New feature: Show a warning before changing the encryption

Bug fix: Fix crash when saving an empty label (Issue #138, PR #139 by Björn Richter)

Bug fix: Fix visibility of thumbnails in dark themes (Issue #88, PR #90)

Bug fix: Don't require credentials again after screen rotation (Issue #152)

Thumbnails: new thumbnails (see the wiki)
[Android Apps and Games] KellyC:
Thanks for this, installing to try out now. I was using FreeOTP from Red Hat... I like it, but their stubbornness on the issue of offering some kind of backup is annoying (just reflashed my phone, so yeah)

---------- Post added at 05:25 PM ---------- Previous post was at 05:18 PM ----------

I mean, neither of these are SMS 2FA, so they aren't vulnerable to SMS attacks... Me, I'd go with this one, just on the basis of having more activity and more contributors. A one person project can be fine and all, but having contributors is a good thing for a lot of reasons, whether regulars or even one-offs . More people to do work, more people have been looking at the code closely enough to write for it, if original maintainer ever steps down there is more likely to be someone who can/will step up, etc
[Android Apps and Games] copong:
Just wanted to show appreciation and say thank you for this great app. I've just finished migrating everything to it as I prepare to wipe my phone.
[Android Apps and Games] x2k13:
Me too, great app, smart and just does what it should. Kudos!
[Android Apps and Games] ralamuri:
Hi,

Thank you for developing such a great app. The encrypted backup using openpgp is great.

However, when i try to create a backup with open pgp i get below error. Any help. I have linked OpenKeychain app and inputted encryption key in settings though.

[IMG="Andotp error"]http://i63.tinypic.com/wbs2tz.png[/IMG]

Thank you,
[Android Apps and Games] flocke000:
Which version of andOTP and OpenKeychain are you using?

Could you head over to Github and file a bug report including a logcat?
[Android Apps and Games] sumade:
Hi,

andOTP is giving a different code compared to google authenticator on the same device with the same secret (TOTP, 30 secs, SHA1). I downloaded it from FDROID. I am not sure how to resolve, the time on my device is correct, and the google authenticator generated code works.

Weirdly it works for another account but not this one.

Any ideas?

Thanks
[Android Apps and Games] flocke000:
How did you transfer the secret from Google Authenticator to andOTP? If it's the same secret and on the same phone to code should always be the same (since it's time based). The only thing I can imagine is that something happened to the secret.
[Android Apps and Games] sumade:
Thanks for the quick reply. I manually entered the keys, and before adding each one copied the secret, and then input that into Google Authenticator after each.

5 out of 7 work in OTP, compared to all 7 in Google Authenticator, since I copied the secret across using the clipboard, I am confident the keys are the same.

I also put the label as the key for testing to allow copy and paste, and tried copying across multiple times, but no luck.

I am not sure what else to try. I will test again.

edit: tried again, I am now certain the same keys are used in each app.
[Android Apps and Games] flocke000:
This is really strange, can you tell me which websites the codes belong to that don't work?
[Android Apps and Games] sumade:
Hi, I now tried with freeOTP (redhat), really oddly, it produces the same codes as andOTP, but both are different to Google Authenticator, which is the only app that works - I now tried quite a few apps, Sophos OTP works as well.

I pm'ed you the website names.

I could regenerate new codes, but don't want to do that just yet as it seems odd and need to work out what is happening - perhaps the keys only work with Google Authenticator - I don't know a great deal about OTP, but I don't think that makes much sense as I guess they all use the same protocol.

update: I made a new account/new email, enabled OTP and it works, really odd - I guess I will just have to generate new keys for my accounts, but find this extremely strange. I made the original account last year I think so it is not like the OTP is likely to be outdated or something.
[Android Apps and Games] sumade:
I generated new keys for the accounts in question, one of them worked first time, the other did not.

I think I have found something consistent though, it seems codes with a zero (0) in them do not work. It seems this may be shared across multiple apps, this is possibly the case for at least andOTP, FreeOTP, and OneTimePass. However, the wrong codes produced are different in each app. I have not tested this exhaustively but every key so far I tried with a zero did not work, the others did - perhaps I am wrong, but bizarrely it really does seem it is the case (perhaps it having a zero in is a fluke, but in case certain keys seem not to produce the right codes on manual entry).
[Android Apps and Games] flocke000:
That explains it. The standard for transmitting TOTP secrets is as Base32-encoded strings. And the Base32 encoding does not allow zeros, only letters from A to Z and numbers from 2 to 7. If the string contains a zero it will not be properly recognized as Base32 by andOTP and the imported secret will be wrong. Maybe I should add a warning and a fallback decoding with a different method in that case...
[Android Apps and Games] sumade:
Thanks, that makes sense,.

However, the QR code scan works in andOTP, I assume Google Authenticator must deal with the zeros in a different way based on what you said - manual entry works in GA but not in andOTP.

edit: I think Google Authenticator automatically converts letter O into zero 0, and I can only assume I entered zero by mistake at some point, although I am sure I tried converting it, I tried this many times so will no doubt have been some errors somewhere when I was testing.

TLDR; this was most likely a mistake by me, combined with the confusion created by Google Authenticator seemingly working. I compared against that to see if the code had been entered correctly on the new phone, when in fact it probably converts O into 0 so was incomparable. I guess incorporating this behavior, or some sort of format check could be good.

Thanks for creating a great (and fully functional!) app, in the end if Google stuck to the standard would never have been tricked into thinking the original key was written correctly.
[Android Apps and Games] Eddie_Brock:
Any plans to use fingerprint authentication to open the app instead of PIN?
[Android Apps and Games] flocke000:
You can already do that. Switch the database encryption to "Android KeyStore" and then the authentication method to "Device credentials", then you can unlock the app with your fingerprint.

It is currently not technically possible to use fingerprint unlocking without the KeyStore. That is because of the way Android implements the fingerprint reading.
[Android Apps and Games] Eddie_Brock:
Cool, I did not see that option. It's working perfectly. Thanks for the great product!
[Android Apps and Games] Eddie_Brock:
What's the trick for getting Instagram working? I've got 10 or 12 different accounts configured, but Instagram seems to be a bit different. It produces a 32 digit code, that despite me trying to use, fails.

Your help is appreciated.
[Android Apps and Games] flocke000:
I don't use Instagram, but we recently had this discussion on Github. The user managed to get it working by removing the spaces from the secret: https://github.com/andOTP/andOTP/issues/253
[Android Apps and Games] lowfront:
Is it true that the first code given from a website can be saved and used as a backup later?

Also If my phone isn't rooted what is the best way to backup my 2FA? Thanks!
[Android Apps and Games] flocke000:
If you mean the QR code that a website gives you to enter into your 2FA app then yes, that can be saved and used to add the same account to a 2FA app again later.

With andOTP you don't need root to backup your 2FA accounts, just use the included backup functions. With most other 2FA apps thats unfortunately not possible (which is basically the reason why I created andOTP).
[Android Apps and Games] MrManson666:
It's so awesome, that andOTP supports Android Backup now. But somehow I can't activate the feature as it is greyed out. Does someone know how to enable it? I use Android Backup in general.
[Android Apps and Games] flocke000:
You need to use the Password / PIN encryption in order to use the Android Backup function. It doesn't work with the Android KeyStore since it can't backup the KeyStore entries.
[Android Apps and Games] MrManson666:
Is Password / PIN encryption less safe than Keystore? To be honest I don't know the exact difference. Thank you so much. I love your app so much!
[Android Apps and Games] flocke000:
It's not less secure, it uses the exactly same encryption (AES256). The only difference is that, if you use the KeyStore you can use your fingerprint to unlock the app (or have no locking of the app at all, which is not recommended of course). And the KeyStore is known to behave buggy on some devices, which can lead to data loss.
[Android Apps and Games] Starphish:
Why would I use "Enable Android Sync". I understand that the app doesn't sync codes between devices, so I'm confused what this does. What backup keys are synced, and how are they different from manual backups (yea... I'm new at this as you can tell).
[Android Apps and Games] flocke000:
"Enable Android Sync" uses Androids internal backup function to backup your database (but only if you use the password / PIN encryption). The internal backup function uses Google Drive to backup and restore your phones data but it doesn't sync between devices.
[Android Apps and Games] onmyouji:
Hi all, I've just found out about this app. One thing I want to ask, has anyone tested if the app can successfully recover the backup to other phone? Just want to make sure before migrating all my account to this app.

Thanks!
[Android Apps and Games] 5t0rmr1d3r:
I recovered my secrets a several times between different versions of android and devices.

Only the andOTP version should match
[Android Apps and Games] beautifulsun:
I see andOTP is not updated since 2018, it's still developed?
[Android Apps and Games] flocke000:
Not really at the moment. I just don't have a lot of free time to spend on it.

But I am planing on publishing a new release with some minor fixes and a lot of new icons later this week.

There won't be any more major update to andOTP though, as I am spending most of my time writing a new 2FA app entirely from scratch.

I wrote a little bit more on the reasons behind that on the Github wiki: https://github.com/andOTP/andOTP/wiki/The-Rewrite
[Android Apps and Games] beautifulsun:
Thanks for the quick and honest response. Can't wait for the new app, it is already available an alpha version?
[Android Apps and Games] flocke000:
Not yet, if you look at the bottom of the wiki page you can see the current status. Once all of the bold points listed there are finished I will release an alpha version.

I will post an update here as well as in the Telegram group as soon as that happens.
[Android Apps and Games] Nekromantik:
while we wait for that is there a alternative to andOTP with more better backup options?
[Android Apps and Games] flocke000:
That depends on what you mean by "better backup options". There is Aegis, which has a more secure implementation of the encrypted backups. Other than that I don't know any maintained open source 2FA app with better backups.
[Android Apps and Games] Nekromantik:
I mean currently on andOTP I cant switch to Android Keystore for my db encryption so cant use tasker to automate backups.
[Android Apps and Games] Nekromantik:
Gotta remember to backup. Last time I forgot and lost 5 new codes. lol

Will check Aegis and come back when new app is out. thanks
[Android Apps and Games] анонимное-f22fcdce:
help needed

Hi, I need some help on setting up automatic backup with Broadcast Receiver and Easer. Can someone shed me some light on this? I tried but both apps really lacking documentations. Also, does broadcast receiver work on OpenPGP encrypted backup? Or it is just for password protected backups?

Thanks a lot.

P.S. To developer, thanks for this great app.
[Android Apps and Games] BowiQc:
Questions about backups

Hello!

I downloaded your app once I discovered that Authy's backup solution is a cloud (?*♂️), but I want to be sure I understand how it works...

Let's say I have to do a factory reset on my phone, or that I buy a new phone... Regardless of the backups method (plain text or encrypted) I choose, does "backing up" requires me to copy the created file on a temporary storage?

Sorry, English isn't my first language and I'm almost incredulous because it seems like your app is perfect for me. ?

So... All I need to do is to save a file, and load this same file later on the same phone or a different one?!

Is it fail-proof?

EDIT: Damn! This thread is dead! :(
[Android Apps and Games] flocke000:
Yes, that is all you need to do. Just make sure to keep the file save.

Yeah it is, most of the discussion is happening on Github or in the Telegram group.
[Android Apps and Games] wooliesq:
Migrating from FreeOTP to FreeOTP+ (a.k.a. FreeOTPPlus) is easy, no need for rooting:

FreeOTP: Export Secrets and Migrate to FreeOTPPlus

Photo by Markus Spiske on Pexels.com This article is about the android app(s) which can be used as 2FA, MFA with TOTP. The original FreeOTP app for android was developed by RedHat, but had no optio…

externalmem.wordpress.com

Hope this helps.
[Android Apps and Games] duhchzff:
AndOTP is flagged as malicious. But only the apk from fdroid (https://f-droid.org/repo/org.shadowice.flocke.andotp_39.apk) and not the apk from github (https://github.com/andOTP/andOTP/releases/download/v0.9.0.1/andOTP_v0.9.0.1.apk).

Fdroid release: https://www.virustotal.com/gui/file...0b69436dff3dac84fbb01a5022b6070a1a7/detection

Github release: https://www.virustotal.com/gui/file...080e951fb03ba0742d1d6e525e62436a76b/detection

I would assume, this is a false positive?
[Android Apps and Games] flocke000:
That is really strange, I will have to look into that. The problem is that I don't build the F-Droid release myself, that is done by F-Droid. So I will have to contact them to figure this out.
[Android Apps and Games] duhchzff:
I created an issue at F-Droid https://gitlab.com/fdroid/fdroiddata/-/issues/2453
[Android Apps and Games] yourrealking:
Is there any technical reason why the minimum Android version is 5.1, not 5.0? I am trying to use an old phone as a dedicated, offline OTP device, and its Android version is unfortunately 5.0.1. I looked up the API changes, and there did not seem to be much of a difference between 5.0 and 5.1.
[Android Apps and Games] yourrealking:
I discovered that the Google Authenticator app now has "Transfer accounts" menu. It seems to be transferring existing entries to GA on another phone. I am not sure how exactly that works, but if GA is generating OTP using the same standards, can't your app use that information to import entries from GA? I have tried scan the "Export" QR code of GA with your app's QR scan feature, but it said "Invalid QR code".
[Android Apps and Games] анонимное-f22fcdce:
Deleted
[Android Apps and Games] CodeScrubber:
I forgot or misplaced my password. I am not sure I backed up the password, I cannot imagini would not.

If I did, where would I find the plaintext backup on my phone? Would it be on google drive,if so where?

How do I completely remove andOTP and any data it creates from my phone?

I tried uninstalling, rebooting and re-installing andOTP. It still asks for a password

I tried deleting all of the application's data, uninstalling, rebooting and re-installing andOTP. It still asks for a password

I do not have my phone rooted and have no interest in doing so.

Please help.
[Android Apps and Games] flocke000:
The backup file can be anywhere, you can choose the location when creating a backup.

If you want to delete all data from andOTP the easiest way would be to go to your phones settings: Apps -> andOTP -> Storage and cache -> Clear storage (this can be called slightly different depending on your phone). This needs to be done while andOTP is still installed.

After that you can set it up again with a new password.