[Unmaintained][App][4.4+][Open source] andOTP - Open source two-factor authentication for Android

[duhchzff]

AndOTP is flagged as malicious. But only the apk from fdroid (https://f-droid.org/repo/org.shadowice.flocke.andotp_39.apk) and not the apk from github (https://github.com/andOTP/andOTP/releases/download/v0.9.0.1/andOTP_v0.9.0.1.apk).
Fdroid release: https://www.virustotal.com/gui/file...0b69436dff3dac84fbb01a5022b6070a1a7/detection
Github release: https://www.virustotal.com/gui/file...080e951fb03ba0742d1d6e525e62436a76b/detection
I would assume, this is a false positive?

 

[flocke000]

That is really strange, I will have to look into that. The problem is that I don't build the F-Droid release myself, that is done by F-Droid. So I will have to contact them to figure this out.

 

[duhchzff]

I created an issue at F-Droid https://gitlab.com/fdroid/fdroiddata/-/issues/2453

 

[yourrealking]

Is there any technical reason why the minimum Android version is 5.1, not 5.0? I am trying to use an old phone as a dedicated, offline OTP device, and its Android version is unfortunately 5.0.1. I looked up the API changes, and there did not seem to be much of a difference between 5.0 and 5.1.

 

[yourrealking]

I discovered that the Google Authenticator app now has "Transfer accounts" menu. It seems to be transferring existing entries to GA on another phone. I am not sure how exactly that works, but if GA is generating OTP using the same standards, can't your app use that information to import entries from GA? I have tried scan the "Export" QR code of GA with your app's QR scan feature, but it said "Invalid QR code".

 

[анонимное-f22fcdce]

Deleted

 

[CodeScrubber]

I forgot or misplaced my password. I am not sure I backed up the password, I cannot imagini would not.

If I did, where would I find the plaintext backup on my phone? Would it be on google drive,if so where?

How do I completely remove andOTP and any data it creates from my phone?
I tried uninstalling, rebooting and re-installing andOTP. It still asks for a password
I tried deleting all of the application's data, uninstalling, rebooting and re-installing andOTP. It still asks for a password
I do not have my phone rooted and have no interest in doing so.

Please help.

 

[flocke000]

I forgot or misplaced my password. I am not sure I backed up the password, I cannot imagini would not.

If I did, where would I find the plaintext backup on my phone? Would it be on google drive,if so where?

How do I completely remove andOTP and any data it creates from my phone?
I tried uninstalling, rebooting and re-installing andOTP. It still asks for a password
I tried deleting all of the application's data, uninstalling, rebooting and re-installing andOTP. It still asks for a password
I do not have my phone rooted and have no interest in doing so.

Please help.

The backup file can be anywhere, you can choose the location when creating a backup.

If you want to delete all data from andOTP the easiest way would be to go to your phones settings: Apps -> andOTP -> Storage and cache -> Clear storage (this can be called slightly different depending on your phone). This needs to be done while andOTP is still installed.
After that you can set it up again with a new password.

 

[CodeScrubber]

The backup file can be anywhere, you can choose the location when creating a backup.

If you want to delete all data from andOTP the easiest way would be to go to your phones settings: Apps -> andOTP -> Storage and cache -> Clear storage (this can be called slightly different depending on your phone). This needs to be done while andOTP is still installed.
After that you can set it up again with a new password.

Thanks, flocke000.

I tried deleting the data and cache, that did not work initially. I was also uninstalling and reinstalling the app as well as rebooting the phone.

Eventually, I just deleted the data and cache and nothing else, that worked.

One thing that would have helped me was a mention or link to the wiki near the top of the GitHub Home page. If one is not familiar with Github, the wiki tab is not obvious.

Sorry I didn't get around to deleting this post before you answered. Thanks for a nice app

 

[IT-Mechanic]

Hi flocke000,

first thanks for your effort by developing with this app. I'm a little bit worried because I can't find the andOTP-App in the Play Store anymore. Did you replaced it with another app or has it been discontinued?

Would be glad to hear from you.

IT-Mechanic

 

[flocke000]

It's not on the PlayStore anymore because Google made a mistake during the review. I submitted an appeal, but have not heard back from them yet. See this issue on Github: https://github.com/andOTP/andOTP/issues/954

But the development of andOTP has been stopped as well because of a lack of time on my side. I am currently working on a complete rewrite during the small amount of time I have.

 

[IT-Mechanic]

OK thank you very much!

 

[flocke000]

Hello everyone,

I have a difficult announcement to make: I am going to stop maintaining andOTP and working on the rewrite for the time being.

As you probably have noticed, andOTP hasn't been updated for about a year now.
I started andOTP when I was still in university and had a lot of time on my hand.
For the last 2.5 years I have been working full-time as software developer and found it increasingly hard to motivate myself to still do some coding in my free time after spending 8h/day coding at work.

The app will stay available on Google Play and F-Droid for the time being, but it won't be updated anymore.
The Github repository will always stay available, but the issues/pull requests will be locked and the repo will be archived.
Feel free to fork andOTP and develop your own app if you want, I just request that you use a different name and give the appropriate credit if you do so.

I might change my mind sometime in the future and resume development (at least of the rewrite), but I currently don't see that happen any time soon.

Thank you guys for all the support over the years and an especially big thanks to all contributors.

Jakob

 

[jsoberg]

Thanks for all the work flocke! andOTP was one of my first forays into open source contributions and I'll always appreciate you being open to PRs from newbies to the scene.

 

[flocke000]

Thanks for all the work flocke! andOTP was one of my first forays into open source contributions and I'll always appreciate you being open to PRs from newbies to the scene.

And thank you for contributing to andOTP! I wouldn't have managed to maintain it as long as I did without contributors like you

 

[pholklore]

Thanks for all the work!

But seriously, why lock/archive the repo instead of calling for help from others to carry the torch, keeping the project alive (without forcing a rename/fork)? A project should be able to outlive its founder.

 

[GalaxyA325G]

I am a noob. Please be gentle with me.

1. My Android 12 is not rooted, and it has no Google Account
2. For privacy reasons that everyone understands
3. I used to get my email for years using the K9 MUA
4. Using login/password authentication
5. On May 30th, 2022 Google deprecated username/passwd
6. Hence Android K-9 stopped working
7. But Windows Thunderbird (with OAuth2 via the web) worked fine
8. So I "thought (wrongly!) that OAuth2 would work on Android
9. So I switched to FairMail because it supports OAuth2
10. However, it CREATED a Google Account on the phone
11. Which is no fault of the wonderful developer!
12. The problem is it costs HIM money to support OAuth2 via web
13. The FairMail developer suggested I use an "otp" program
14. Because of 2FA/2SV/MSA/MSV privacy implications
15. Because I do NOT want my phone number associated with email
16. Which is what brought me to this thread.
    • andOTP - Android OTP Authenticator by Jakob Nixdorf
    • free, no ads, no gsf, rated 4.3, 100K+ installs
    • Google Play, F-Droid, GitHub, XDA

The problem is that I'm a noob, and that I was forced into use of 2FA/2SV/MFA/MSV which means I'm just trying to recover from Google's May 30th elimination of login/password authentication for 3rd-party MUAs on Android.

• I was using login/password on Android until May 30th
• Now I have to use "something else"
• Almost every "something else" requires 2FA/2SV/MFA/MSV
• Even "app passwords" do
• And I don't have any hardware or USB token equipment
• As I'm just a noob user who wants to read my email
• Using a 3rd-party MUA (becuase GMail also CREATES an account)

So I'm resigned to have to use 2FA/2SV/MFA/MSV.
Hence I'm just trying to follow the FairMail developer's suggestion.
Of using an OTP app.

The issue with being a noob is I don't know how to USE an OTP app!
I haven't (yet) found a step-by-step tutorial for a user like me.

• I don't have a Google Account on my phone
• And I don't want one (so OAuth2 isn't available to me)
• I just want to log into my Google email account
• It seems that my only logical choice is 2FA/2SV/MFA/MSV

But I don't know what to put into the form when andOTP comes up.
And reading this thread didn't tell me what to put into the forms.

I guess I'm just supposed to know.
But I don't.

Flocke's nicely written andOTP asks for one of three things:

1. Scan QR code
2. QR code from image
3. Enter details

Being a noob, but knowing "what" a QR code is, I first state that I have no idea whatsoever WHERE I'm supposed to GET that QR code; but luckily, there's that third option of manually entering the details.

The details Flocke's nicely written andOTP asks for are:

1. Type = TOTP (available are TOTP, HOTP, MOTP & STEAM)
2. Issuer = <blank> (editable)
3. Label = <blank> (editable)
4. Secret = <blank> (editable)
5. Tags = <blank> (editable)
6. Period 30 (editable)
7. Digits = 6 (editable)

My question...

Q: What is the typical set of details above for a typical 3rd-party MUA to access a Google Email Account [for a user who has no accounts on his phone (not Google, not Samsung, not to any mothership)]?

 

[scientia_2]

Three days ago my entire list of accounts disappeared from the application. Using restore did nothing. I am sorry to hear that no further development is being made - I am a supporter of open-source technology and development for many, many years.

 

[matrasul]

Thanks for the app, I will test in detail
Greetings

 

[e5e197740b]

OTP standard have been finalized and static for years.
Saving files in a save and encrypted manor ond a smartphone is fairly worked out and unlikely to change anytime soon.

Therefore my question:

Can I still recommend AndOTP to friends who are not that tech savy?

I'd hate for them to use the Google, Microsoft variants or Authy. And the only other things seems to be FreeOTP and I never tried that and it has RedHat as a publisher.

I hope somebody carries the torch and makes a fork the community can come together on.