-
-
Notifications
You must be signed in to change notification settings - Fork 276
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
This triggered the |
But the workflow is gone from both release and develop branches, so how? I don't see it in my 'Checks' list either. |
No idea, I just saw it pop up here: https://github.com/android-password-store/Android-Password-Store/actions/runs/151222874 |
Might have been an older branch that I pushed, I just saw that |
* develop: (62 commits) Scroll to files and enter folders when created (android-password-store#909) Run a treewide reformat (android-password-store#908) Improve how secrets and stored and used (android-password-store#907) Improve and refactor Autofill heuristics (android-password-store#905) Use PreferenceKeys file to manage SharedPreferences keys. (android-password-store#891) Revert "Support directly importing secrets" (android-password-store#904) Allow importing TOTP configuration through QR codes (android-password-store#903) Bump version Prepare release 1.9.2 update changelog Workaround to prevent crash on first run (android-password-store#898) Workaround to prevent crash on first run (android-password-store#898) Offer TOTP Autofill for OTP fields (android-password-store#899) Merge SshKeyGenFragment into its activity (android-password-store#897) Reintroduce TOTP support (android-password-store#890) Sync with release branch (android-password-store#896) build: bump version Prepare release 1.9.1 Backport Actions fixes (android-password-store#894) Rework GitHub Actions (android-password-store#893) ...
📢 Type of change
📜 Description
Make (modern) Autofill detect OTP fields and offer to fill them with TOTPs calculated from a secret stored in the encrypted extras.
OTP fields are currently detected based on the W3C hint
one-time-code
, amaxLength
between 6 and 8 and/or the strings "otp" and "code" in attributes. For now, we don't allow filling both OTPs and passwords/usernames at the same time since I have never seen a site do this.💡 Motivation and Context
TOTPs are here to stay and we should do our best to protect them from phishing. It also turns out that our Autofill implementation is flexible enough that adding support for this requires only ~100 changed lines.
Fixes #663.
💚 How did you test it?
I verified that this works with Amazon in Chrome and that existing workflows are not obviously broken. Since I rarely use OTPs, I would like to let the snapshot users test this more thoroughly and focus on fixing the issues they find.
📝 Checklist
🔮 Next steps
I will look into providing autofilled OTPs from SMS.
📸 Screenshots / GIFs