RE: Re: Feedback on patch for #69

[Philip Gillißen]

Nathaniel wrote:
> I am planning to address this bug in the next revision which will
> contain fingerprint support (via my new Nexus 5x). It will require a
> rewrite of this code and I'll address it then.

Ok, this sound good, thank you!
> I do not intend to support token export. Users should create multiple
> tokens or use TOTP. Servers which only support a single HOTP token
> should be fixed.

I thought more of a backup functionality instead of a multi-device token export.
So that you can export your current tokens and import it later on if you crashed your device.
Is that also not of interest?

Thanks
Philip

---
Alle Postfächer an einem Ort. Jetzt wechseln und E-Mail-Adresse mitnehmen! http://email.freenet.de/basic/Informationen

Feedback on patch for #69

[Nathaniel McCallum]

On Mon, 2015-11-09 at 16:58 +0100, Philip Gillißen wrote:
> Nathaniel wrote:
> > I am planning to address this bug in the next revision which will
> > contain fingerprint support (via my new Nexus 5x). It will require
> > a
> > rewrite of this code and I'll address it then.
>
> Ok, this sound good, thank you!
> > I do not intend to support token export. Users should create
> > multiple
> > tokens or use TOTP. Servers which only support a single HOTP token
> > should be fixed.
>
> I thought more of a backup functionality instead of a multi-device
> token export.
> So that you can export your current tokens and import it later on if
> you crashed your device.
> Is that also not of interest?

Backup is just another word for people stealing your cryptographic
keys. :)

The problem with backup is that it pushes the management of (lost,
stolen, etc) tokens from the server (where appropriate policy can be
applied) to the client (where it can't).