Retaining Knowledge of the Secret Code #810
Librechain
started this conversation in
Ideas
Replies: 1 comment
-
The application just stores the secret and generates QR codes when you click on the button. You can test that by changing the issuer or account name and using the QR code. |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
This app is great. However, like most Authenticator apps, I noticed that it only keeps the QR Code (photo) rather than the actual secret. Wanted to propose keeping the secret for all entries (or at least affording users that option, maybe with a 'switch' of some sort within the app).
Since everything is being encrypted with the iOS keychain, it feels like there's no decrease in security / reliability for the app.
Reason for Suggesting
I find the actual code itself to be a lot more portable + flexible for different situations. QR Codes can sometimes be cumbersome to transport from one app to the next. They also deprive the end user of absolute knowledge (tangibly) of the actual secret itself.
I know the goal here may be to not expose the raw secret to reduce attack surface, but I would argue whether that actually achieves this intended purpose (if that's not the goal, correct me please). Curious to get dev's thoughts on this proposal.
Beta Was this translation helpful? Give feedback.
All reactions