For example, what Cloudflare and Humble Bundle used to use, and
what Twitch.tv uses currently.
The difference to the regular "authenticator tokens" seems to be
that the tokens are issued on a per-device basis, which presumably
makes them revocable. Since Authy is the authoritative issuer of
these tokens, they are not encrypted in the API. The other difference
is in the key length and the period (10 seconds rather than 30).
Fixes#3.
Will use Name if it is available, and otherwise will use UniqueID, which
is not descriptive but should always be available.
Should fix one of the complaints reported in #1.
Unfortunately I had assumed that TOTP secrets are always aligned
to the AES block size (16 bytes), but this turns out not to be the
case.
As a result, these tokens would have been decrypted incorrectly.
This commit (hopefully) properly unpads the cleartext after decryption.
Alex Zorin
Kai Michael Poppe
Lukáš Zapletal
Dan Jones