TOTP Turistu מאת

This is a javascript implementation of a TOTP authenticator, using the browser's crypto API. It should do the exactly same thing as google's authenticator, the "oathtool --totp -b ..." command, or any other TOTP generating app.

The javascript code does not send to or fetch any data from anywhere remotely, and it should work the same when served over https, saved locally or used inside a browser extension.

Instead of implementing its own secret saving mechanism (with cookies or local storage), this extension is using the browser's password manager to save the TOTP keys, just like any other passwords.

Since the saved keys are attached to the extension's own "moz-extension://UUID" url, not to the website where they are used, it's not possible for hijacked websites to retrieve them by exploiting the form and passwords autofill mechanism.

This extension is also not using any content script which could be tricked into generating and filling in TOTP codes without user intervention.

Note for Linux/X11 users: Since their half-fix to the exploitable pastejack bug that I have reported, it's no longer possible to copy the totp code to the primary selection automatically upon it being generated. If you still want to paste it with a simple middle-button click, just click once more on the totp code when you see the "copied (for ctrl-V)" message. Sorry for that.