Hide the secret code sent in messages (paranoid mode)

[oleua]

Hi! I am a bit worried about displaying one-time codes in messages of my messengers, so I decided to find out how to hide it.

As I use only Signal as 2FA, I have modified manually /apps/twofactor_gateway/lib/Provider/AProvider.php
by adding:

85 $secret = '||'.$secret.'||';

Next time when I receive a code via Signal I will find it hidden like

In order to view it I have to click it and will see the numbers.

[vitormattos]

Are you talking about the integration with Telegram?

[oleua]

What Telegram? Signal, of course, perhaps other messengers, just to study how to do it there.

[vitormattos]

Sorry, I made a quick read and didn't saw "Signal" and thought that was Telegram. Telegram also have the possibility to format as "spoiler". It's a good suggestion but will be necessary think a bit more and wait for more interactions of other Signal users about how to implement this.

Follow some points to we think:

1. Would be good to add at Signal and Telegram configuration flow, a system field (system because don't will be specific to Signal implementation) called "spoiler" asking if want to enable the spoiler feature and at AProvider, add a more condition to configure the text with spoiler markdown syntax. This will make more customizable.
   

   twofactor_gateway/lib/Provider/Channel/Signal/Gateway.php

   Lines 50 to 60 in 4812fa9

   	fields: [
   	new FieldDefinition(
   	field: 'url',
   	prompt: 'Please enter the URL of the Signal gateway (leave blank to use default):',
   	default: 'http://localhost:5000',
   	),
   	new FieldDefinition(
   	field: 'account',
   	prompt: 'Please enter the account (phone-number) of the sending signal account (leave blank if a phone-number is not required):',
   	),
   	]

2. Will be necessary to add a new setting to Signal Gateway file allowMarkdown: true,, could be before fields. You can test this. Setting this already will send the token as code syntax and will make a small improvement into Signal flow.

[oleua]

Sorry, I made a quick read and didn't saw "Signal" and thought that was Telegram. Telegram also have the possibility to format as "spoiler". It's a good suggestion but will be necessary think a bit more and wait for more interactions of other Signal users about how to implement this.

Follow some points to we think:

1. Would be good to add at Signal and Telegram configuration flow, a system field (system because don't will be specific to Signal implementation) called "spoiler" asking if want to enable the spoiler feature and at AProvider, add a more condition to configure the text with spoiler markdown syntax. This will make more customizable.

     [twofactor_gateway/lib/Provider/Channel/Signal/Gateway.php](https://github.com/nextcloud/twofactor_gateway/blob/4812fa912783401720dccb3abf2d54d51d0309ca/lib/Provider/Channel/Signal/Gateway.php#L50-L60)
   

Thank you for your reply! So, how do you suggest to add the field?

2. Will be necessary to add a new setting to Signal Gateway file allowMarkdown: true,, could be before fields. You can test this. Setting this already will send the token as code syntax and will make a small improvement into Signal flow.

[oleua]

Additionally, I suggest to autodelete the sent OTP codes in a 1 minutes after sending.

For Signal this can be:

sleep(1m)
curl -X 'DELETE' 'http://<ip>:<port>/v1/remote-delete/<registeredPhoneNumber' -d '{"recipient": "<recipientPhoneNumber>", "timestamp": <timeStamp>}'