0

I follow the same approach explained here.

I am using PHPGangsta_GoogleAuthenticator like so:

$ga = new \PHPGangsta_GoogleAuthenticator();
$qrCodeUrl = $ga->getQRCodeGoogleUrl(urlencode('trading.com/'.$user->email), $user->two_fa_secret);

If the user has email adress = someguy@mysite.com, then the app will show "trading.com/someguy@mysite.com". And the second parameter is the actual secret used to generate the code.

What bugs me, is that it generates this:

<img src="https://api.qrserver.com/v1/create-qr-code/?data=otpauth%3A%2F%2Ftotp%2Ftrading.com%252Fsomeguy%2540mysite.com%3Fsecret%3D4UYJ************&amp;size=200x200&amp;ecc=M" alt="Loading....">

The secret for the actual app is: XOB*************, so it's not exposing the actual secret in the URL. But can this URL not be used maliciously?

I am wondering:

  1. if I should not perhaps use the URL to download the QR Code instead of displaying it with the URL that the PHPGansta library generates?
  2. if api.qrserver.com is not a security threat, because i mean, who are they? I am sending them all the details they need to get passed the 2fa authentication. So a breach at api.qrserver.com, would be very bad for me. Or is api.qrserver.com = google, and therefore okay?
Jonas
  • 121,568
  • 97
  • 310
  • 388
rockstardev
  • 13,479
  • 39
  • 164
  • 296

1 Answers1

1

Yeah, you are not wrong... this seems like a terrible idea.

This about it this way, even if the literal secret does not appear in the URL, the QR code is enough to generate valid 2FA codes.

And yea, you are sending this code to a third party. I would strongly advise against this.

Also you are using a library called PHPGangsta, and it hasn't been updated since 2016. None of this creates trust.

Evert
  • 93,428
  • 18
  • 118
  • 189
  • You dont perhaps know what is the recommended way to do this in PHP? Is there perhaps an official google library? – rockstardev Nov 23 '20 at 07:53
  • 1
    @coderama I don't, but I would look for more general TOTP libraries. Google is just 1 implementation of this, but it's not the name of this protocol. – Evert Nov 23 '20 at 08:19