Hacker News Reader

Comment by StavrosK | Hacker News Reader

FreeOTP is great, unfortunately it's unmaintained. There are so many easy features it could get (e.g. a search box) but nothing is going on.

View on HN

As a current contributor, I know that's just not true https://github.com/freeotp/freeotp-android/commits/master

If a search box is desirable I'd recommend upvoting an existing feature request on there or submitting a PR for that if you're an android developer too.

Could you guys push an update to the App Store please? The current version is 3 years behind. I also thought the project was unmaintained until just now.

Also, the first link in the article points to https://fedorahosted.org/freeotp/ but is redirected to a retirement message:

> fedorahosted.org was retired on March 1st, 2017. If you are viewing this page, odds are it's after that date and you have been redirected here by attempting to go to some project on fedorahosted.org.

Further down the page it says [if you are a maintainer]:

> We are also happy to setup redirects for your project to a new location. Just file a issue in https://pagure.io/fedora-infrastructure and we will try and help you out.

Know nothing about FreeOTP (though sounds interesting!), but my first impressions was also that it probably isn't active, given they haven't decided to set-up a 301 to the new project home.

(EDIT: Typo 'pointa' -> 'points')

I'm glad to hear that, but I don't know how valid your assertion is when scrolling just a bit down the first page brings up commits from 2014. I went to file/upvote the search box issue a few weeks ago, and the 71 open issues weren't encouraging.

Then, I figured I'd learn Android development and submit a PR, but saw 15 open ones from years ago and figured the project was unlikely to ever merge my PR and just left.

In my defense, those signs don't scream "maintained project" to me.

Check out Authenticator for iOS. Open source and has builds posted in the App Store

https://github.com/mattrubin/Authenticator

https://itunes.apple.com/us/app/authenticator/id766157276?mt...

Unfortunately (because that looks great), I use Android, thank you though.

From the readme:

> Secure: All data is stored in encrypted form on the iOS keychain

I suppose this means it's using the secure enclave behind the scenes?

Is the encrypted data (encrypted with what key?) part of the device iCloud backup?

It is maintained by Red Hat (and it's the suggested OTP soft token for RH employees).

When I was on Android, I never saw any reason not to use the open source Google Authenticator version (still available via F-Droid, or relatively easy to compile yourself). It's simple, it's fast, it's open, and it works.

Hmm, that's a good alternative. Do you have a link to the F-Droid version? I can't seem to find it there.

EDIT: It looks like it was taken down because it uses an MD5 signature for the APK.

If that is the reasoning that would be very hipocritical of Google.

I know for a fact they use MD5withRSA for some of their own apks including YouTube - https://www.josephkirwin.com/2016/05/05/humbled-by-md5/

* at least they did at the time that was written.

MD5 APK signatures are still supported by Android and are accepted by Google Play when you upload an APK there.

See https://forum.f-droid.org/t/many-old-unmaintained-apps-have-... for more discussion about this in the context of F-Droid. I believe F-Droid was (is) using Oracle jarsigner to verify APK signatures and this is what causing F-Droid to reject APKs with MD5 signatures.

Reply on news.ycombinator.com