|
||||
2FA
2FA
| Title: | |
| Seed: | |
|
||||
| Click button above again to hide | |
| Passphrase: |
This should be long & difficult to guess, for security. Stored: Stretched to: Nonce: |
Restore by pasting the contents into the "Update from backup" field, and then click "Update". The backup will update your local database, it won't delete entries not present in the backup.
This is what a backup looks like:
{
"cryptoText": "Cpl3aA979MF8sbDgXJhqlQxJk4Wv6QKVMdtxLgTNoGwsa3",
"keyStretchFactor": {
"logN": 16,
"r": 8,
"p": 1,
"dkLen": 32,
"encoding": "hex"
},
"keyStretchMethod": "scrypt",
"cipher": "chacha20",
"nonce": "30bc02549c74cf7b8d92b9f1"
}
The password in tootp needs to be the same at the moment of restoring as it was when the backup was made.
Click the "Start" button to start scanning. When the scanner finds a qr code, it will automatically put it into the "Seed" field at the top. Click "Stop" to stop scanning. The only way to turn the camera off completely as of now, is to reload the page. Currently the scanner puts everything in the qr code into the seed field. You may want to clean that up before saving, if there is other data than just the seed there.
All seeds and the password are stored in cleartext in localstorage in your browser.
It is recommended that you save the source of this page as a backup, so that you always have a copy of the precise execution environment for restore purposes, in case there are unintentional quirks of the encryption in tootp. Beware that if you run tootp as a local file, in my tests it seems that in some versions and browsers locally opened files share and hence can read each other's local storage entries. In others it seems that there is separate localstorage for each file location.
If you are afraid of exploits in the browser getting at tootp data, consider running tootp in its own browser, maybe even in an environment that does not have network access. If you are worried about local keyloggers and screen scrapers having infected your system, then run tootp on another device than the one you log in on. This is the usual way of running totp clients.
However if your system is in that bad shape so that the attacker can manipulate your screen, you could still be compromised in different ways, regardless of defensive technology used.
You may well want to choose a long and difficult password. It is stored in localstorage by tootp, so you do not need to re-enter it. You can always display it to see what it is and if you have configured multiple devices, chances are that you have at least one of them left in your possession at any given time. If you believe that your seeds have been compromised, you should change the password and request new seeds from the sites.
Consider hosting the tootp page on its own sub domain, being the only page on that sub domain, see: Same-origin policy - Wikipedia (local storage is supposed to follow the same rules as listed there. "Failure" is good in that table btw, for our purposes).