Elytrium / Elytrium/LimboAuth

[BUG] Saving TOTP recovery codes is not implemented

Open
#47 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Java
Stars
238
Forks
125
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**
LimboAuth generates TOTP scratch codes, but doesn't store them anywhere ([see there](https://github.com/Elytrium/LimboAuth/blob/fa0c8b27b0d3bcafd3b7893b7730aa69849965aa/src/main/java/net/elytrium/limboauth/command/TotpCommand.java#L146)).
`dev.samstevens.totp.recovery.RecoveryCodeGenerator` just provides N random strings, that should be stored yourself.
TOTP doesn't describe recovery codes, it's a mechanism that is outside the scope of TOTP.

**Possible solution**
Add table column or separate table for storing generated recovery codes.

p.s. I think such long alphanumeric strings for recovery codes is a bad idea for a Minecraft server. It might be better to generate small integers, such it does [GoogleAuth](https://github.com/wstrange/GoogleAuth/blob/91118dcb356fca6eb1985043c2fff206031fc437/src/main/java/com/warrenstrange/googleauth/GoogleAuthenticator.java#L503).

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.