Skip to content

Commit

Permalink
Relax requirement for 128 bit totp secrets
Browse files Browse the repository at this point in the history
totp-rs is strictly RFC6238 compliant. This is a good thing, but the
reality is many sites/apps are still using 80 bit secrets for TOTP.
These include Github, Discord, Paypal, among others. The author of
totp-rs added a function `from_url_unchecked` to address this in this
issue: constantoine/totp-rs#46. I suggest we
use it here so that ripasso can be used practically for totp.
  • Loading branch information
Fingel committed Sep 16, 2024
1 parent 998e87f commit a515ac6
Showing 1 changed file with 3 additions and 1 deletion.
4 changes: 3 additions & 1 deletion src/pass.rs
Original file line number Diff line number Diff line change
Expand Up @@ -1041,7 +1041,9 @@ impl PasswordEntry {
}
end_pos
};
let totp = TOTP::from_url(&secret[start_pos..end_pos])?;
// Use unchecked for sites like Discord, Github that still use 80
// bit secrets. https://github.com/constantoine/totp-rs/issues/46
let totp = TOTP::from_url_unchecked(&secret[start_pos..end_pos])?;
secret.zeroize();
Ok(totp.generate_current()?)
} else {
Expand Down

0 comments on commit a515ac6

Please sign in to comment.