One-Time Password Client - Samsung YH-920 Manual

Chapter 12. Plugins
rumbling: 4 3/4 90 X.x
ramp-up: 8 2/4 90-150
flow: 4
death: 8
final: 1 1/1 60

12.4.15. One-Time Password Client

This plugin provides the ability to generate one-time passwords (OTPs) for authenti-
cation purposes. It implements an HMAC-based One-Time Password Algorithm (RFC
4226), and on targets which support it, a Time-based One-Time Password Algorithm
(RFC 6238).
Adding Accounts
The plugin supports two methods of adding accounts: URI import, and manual entry.
It is important to note that for TOTP (time-based) accounts to work properly, the
clock on your device MUST be accurate to no less than 30 seconds from the time on the
authentication server, and the correct time zone must be configured in the plugin. See
section 11 (page 87) for more information.
URI Import
This method of adding an account reads a list of URIs from a file. It expects each URI
to be on a line by itself in the following format:
otpauth://[hotp OR totp]/[account name]?secret=[Base32 secret][&counter=X][&period=X][&di
An example is shown below, provisioning a TOTP key for an account called "bob":
otpauth://totp/bob?secret=JBSWY3DPEHPK3PXP
Any other URI options are not supported and will be ignored.
Most services will provide a scannable QR code that encodes a OTP URI. In order to
use those, first scan the QR code separately and save the URI to a file on your device.
If necessary, rewrite the URI so it is in the format shown above. For example, GitHub's
URI has a slash after the provider. In order for this URI to be properly parsed, you
must rewrite the account name so that it does not contain a slash.
Manual Import
If direct URI import is not possible, the plugin supports the manual entry of data
associated with an account. After you select the "Manual Entry" option, it will prompt
you for an account name. You may type anything you wish, but it should be memorable.
It will then prompt you for the Base32-encoded secret. Most services will provide this
to you directly, but some may only provide you with a QR code. In these cases, you
The Rockbox manual
# 3/4, first (tick) and last (tock)
# speeding up to 150 bpm again
150 # steady 4/4 at 150 bpm
150-60 # going down to 60
# one last hit
(version 3.14)
161
Samsung YH-920