Foil Auth

Your rating: None Average: 5 (12 votes)

Secure OTP (One-Time Password) generator for Sailfish OS.

Its functionality is similar to SailOTP except that Foil Auth keeps secret authentication keys encrypted with your Foil password. Only time-based (TOTP) passwords are supported in this version.

Foil password (and the RSA encryption key ~/.local/share/foil/foil.key) is shared with Foil Pics and Foil Notes. Encrypted authentication keys for OTP generation are stored in ~/Documents/FoilAuth.

The format of the encrypted file is described here.

Source code:

Application versions: 
File harbour-foilauth-1.0.9-14.1.armv7hl.rpm299.11 KB13/10/2020 - 01:29
File harbour-foilauth-1.0.9-14.1.i486.rpm351.27 KB13/10/2020 - 01:29
File harbour-foilauth-1.0.8-12.1.armv7hl.rpm300.59 KB08/10/2020 - 02:23
File harbour-foilauth-1.0.8-12.1.i486.rpm353.29 KB08/10/2020 - 02:23
File harbour-foilauth-1.0.7-11.1.armv7hl.rpm298.25 KB03/01/2020 - 19:39
File harbour-foilauth-1.0.7-11.1.i486.rpm350.45 KB03/01/2020 - 19:39
File harbour-foilauth-1.0.6-10.1.armv7hl.rpm297.09 KB12/11/2019 - 03:02
File harbour-foilauth-1.0.6-10.1.i486.rpm348.5 KB12/11/2019 - 03:02
File harbour-foilauth-1.0.5-9.1.armv7hl.rpm289.9 KB22/04/2019 - 13:06
File harbour-foilauth-1.0.5-9.1.i486.rpm340.12 KB22/04/2019 - 13:06
File harbour-foilauth-1.0.4-8.1.armv7hl.rpm289.68 KB13/04/2019 - 00:41
File harbour-foilauth-1.0.4-8.1.i486.rpm339.26 KB13/04/2019 - 00:41
File harbour-foilauth-1.0.3-7.1.armv7hl.rpm288.45 KB11/04/2019 - 15:03
File harbour-foilauth-1.0.3-7.1.i486.rpm337.9 KB11/04/2019 - 15:03
File harbour-foilauth-1.0.2-6.1.armv7hl.rpm287.17 KB11/04/2019 - 01:18
File harbour-foilauth-1.0.2-6.1.i486.rpm336.38 KB11/04/2019 - 01:18
File harbour-foilauth-1.0.1-5.1.armv7hl.rpm285.06 KB10/04/2019 - 18:37
File harbour-foilauth-1.0.1-5.1.i486.rpm335.06 KB10/04/2019 - 18:37
File harbour-foilauth-1.0.0-4.1.armv7hl.rpm284.31 KB10/04/2019 - 14:46
File harbour-foilauth-1.0.0-4.1.i486.rpm333.54 KB10/04/2019 - 14:46
  • 1.0.9 (Oct 12 2020)
    - Fixed a problem with initial update of current passwords
    - More dialog titles
  • 1.0.8 (Oct 7 2020)
    - Added German translation
    - Use stronger SHA256 digest for signature
    - Tweaked password change UI
  • 1.0.7 (Jan 3 2020)
    - Support for scanning inverted QR codes
    - Autolock is delayed by 15 seconds
    - Miscellaneous UI tweaks
  • 1.0.6 (Nov 12 2019)
    - Freshened up the UI
  • 1.0.5 (Apr 22 2019)
    - Query the actual maximum zoom from the camera
    - Improved French and Polish translations
  • 1.0.4 (Apr 12 2019)
    - French translation
  • 1.0.3 (Apr 11 2019)
    - Swedish translation
  • 1.0.2 (Apr 11 2019)
    - Chinese translation
  • 1.0.1 (Apr 10 2019)
    - Polish translation
  • 1.0.0 (Apr 10 2019)
    - Initial version


MacGyver's picture

Just wondering, if you ever thought of having a way to backup things to SD card from app itself?
Now I have a script, that creates a backup of the files on my SD card, but its a bit of a hassle.

slava's picture

Yes, I did think about it (and even drafted a prototype) but decided to write a separate backup app instead, which would cover all my Foil apps at once and possibly any custom user-specified dconf/filesystem entries in addition to that. But that app isn't ready yet.

MacGyver's picture

Ok, cool, I will keep my eyes open for it then :)

MacGyver's picture

Are you adding HOTP support in near future? Id like to use this app instead of SailOTP, just cause it has the codes behind encrypted password and not open to everyone like SailOTP if they get access to phone.
I guess no need for import/export, cause you can just copy the ~/Documents/FoilAuth file? Do I need to backup the ~/.local/share/foil/foil.key file too? Just wanna know how correctly backup things, if anything bad happens to phone!
I have multiple Jolla devices and would like to copy tokens to those too. How can I accomplish this?

slava's picture

You mean counter-based OTP? That shouldn't be too hard, I just wasn't sure if anyone is using that.

As for backup/export, yes you need both ~/Documents/FoilAuth directory and ~/.local/share/foil/foil.key file - the latter is the RSA private key required for decrypting your tokens (the key itself being AES-encrypted with your password)

MacGyver's picture

Actually, I might need to recheck, if HOTP is used anymore, I guess TOTP has surpassed it these days.

And thanks for the backup info, now I can sleep knowing my tokens are safely backed up, and encrypted.

Surprisingly few authentication apps have own password as added security layer. I guess most people think it more of a hassle...

slava's picture

I'll tell you more :) If you build foilmsg tool then you can decrypt your auth tokens on your computer, you don't need a phone for that. Suppose you have pulled a file named 5E6FD647B7683FAC from your ~Documents/FoilAuth directory. And foil.key file too, of course. Then you can do something like this:

$ foilmsg -d -s foil.key -P xxxxxxxx -f 515B8BF49C1DF7E5 -o secret -v
[foilmsg] Private key fingerprint: 53:ae:7e:54:c2:d2:43:88:2a:98:a0:24:4a:90:66:1f
[foilmsg] Found 3 header(s)
[foilmsg]   OTP-Label: test2
[foilmsg]   OTP-Favorite: 1
[foilmsg]   OTP-Digits: 6

where foil.key is your foil private key file, xxxxxxxx is your foil password. Your secret token is written to the file named secret in the binary form, i.e. as a sequence of raw bytes - in order to get the token string the way you see it in FoilAuth app, you would have to run your secret bytes through a Base32 encoder.

MacGyver's picture

Interesting, so you could easily move your tokens to other apps too using this method, if needed? Anything can happen, gotta be prepared :)

24mu13's picture

Interesting thinking about fingerprint authentication: I'm still convinced it's useful and convenient, anyway. What about to have both for instance? Password first time, fingerprint for kind of quick unlock?

nobodyinperson's picture

This is a really neat app!

TheJullus's picture

Would it be possible to make an option to use fingerprint authtentication for unlocking these foil apps? (Possible in sense of being able to do it and also if it's against the security idea you have (as in "password stronger that PIN code"))

slava's picture

Hehe, I was actually considering something like that but it turned out to be impractical and in many ways less secure. Probably the best argument which I heard against that or any kind of biometric authentication in general - "you can change your password but you can't change your fingerprint". When it comes to the actual implementation, it turns out that on most systems you don't have access to raw fingerprint images. You can only match the current fingerprint against the training set and that's it. It's just not enough to generate any kind of hash or anything that could be used as an encryption key.

TheJullus's picture

Is it some how possible to use old codes after resetting the phone? I tried to use this app with same password but it says there is no codes (or notes in FoilNotes) Ps. Would it be possible to use fingerprint authentication to open the Foil apps?

slava's picture

I'm afraid you've lost your auth token forever and need to request a new one :/ Once the old encryption key is gone, there's no way to recover encrypted data. At least there sholdn't be by design, unless the design is flawed (I hope not).

TheJullus's picture

I do have the auth token because I did a backup of my nemo folder. I just switched foil.key in .../nemo/.local/share/foil and it works just fine!!

slava's picture

Good! Just don't lose your key and don't forget your password :)

glanternier's picture

Ok. I now understand how it works. I had to use inWebo anyway because the helpdesk was being stupid and rigid about this, but I understand what I have to do next time if I want to use the native app. Thanks !!!

glanternier's picture

Hello, I want to use Foil OTP to register my O365 account at work, but the IT helpdesk insists on going with an Android app called inWebo. I think that I could use Foil OTP instead, but I don't understand how OTP works technically so I am not sure. The helpdesk will not help me of course. Seeing an non Android / iOS device almost caused them a panic attack :-(

slava's picture

If you enter your foil password, select "Add Token" from the pulley menu and press "Scan QR code" button (they provided you the QR code, didn't they?), you should be able to import the token and use Foil Auth for authentication.

These "one time passwords" are essentially one long password (the secret= part of otpauth:// URL), out of which a shorter one is generated based on the current time. The algorithm implemented by Foil Auth is described here

direc85's picture

Works well, great app!

explit's picture

Absolut great like all your apps, Slava!

minitreintje's picture

The Foil apps are simple, polished and work really well! Thanks Slava!

Historyscholar's picture