Steps to replicate the issue (include links if applicable):
- Install FreeOTP on your phone (verified via an Android device)
- From an OATH-enabled account, go to Special:OATHManage and enable TOTP-based 2FA
- Scan the QR code on FreeOTP
What happens?:
FreeOTP claims that:
Token is unsafe!
The token you are attempting to add contains weak cryptographic parameters. Use of this token is strongly discouraged! Please alert your token provider.
What should have happened instead?:
FreeOTP adds the 2FA details and starts generating TOTPs.
Other information (browser name/version, screenshots, etc.):
I'd love to provide a screenshot, but FreeOTP's security policy prohibits me from taking one. The error message (verbatim) is provided above.
This is fairly important to fix on our side, as FreeOTP is high on the list of recommended apps in our official manual. This means users who are unfamiliar with TOTP apps are quite likely to land on FreeOTP specifically, and then be confused/discouraged by the warning they see.
Creating this ticket, as I was approached by @OJJ (a Czech Wikipedia checkuser) with a request for advice.