A native, lightweight and secure time-based (TOTP) & counter-based (HOTP) password client built for iOS

Is your feature request related to a problem? Please describe. No it's not.

Describe the solution you'd like I would like for Raivo to have it's own static site. What i mean by this is that, i would like for this project to start it's own website to where people can visit it to find and download Raivo. Rather than forcing people to use the GitHub repo.

Additional context I would like for Raivo to have it's own static site. To make it easier for people to find, navigate, and download the application. The less technical people in the crowed won't probably even know what GitHub is and that's why i would recommend you look into this. You can host a website for free with GitHub pages and register a domain with namecheap.com or porkbun.com for example, to get a domain like "raivo.org", "raivo-otp.com", and or "theraivoproject.org".

Describe the bug While trying to select a storage provider, the option Personal iCloud is greyed out and cannot be selected. Is it because I'm on iOS 15 beta?

To Reproduce Go to initial setup and try to select storage provider.

Expected behavior It should be possible to choose Personal iCloud as a storage provider, or at least provide a message explaining why it is not available.

Screenshots Please note that the last option is also slightly clipped, as reported in issue #43

Smartphone

• Device: iPhone X
• OS: 15.0 beta
• Version 1.2.2

Describe the bug Raivo OTP Version 1.4.0 (build-60)

The export functionality seems broken. When you click to export, it is creating a 22 bytes .zip archive that is empty when opened with a computer using 7zip. The archive doesn't require the password to be opened. When using export, I tried "Save to files" and also "Send email", but it doesn't change the fact that archive seems corrupted.

To Reproduce Steps to reproduce the behavior:

1. Go to 'Settings'
2. Click on 'Export OTPs to ZIP archive'
3. Click on 'Export'
4. See that the archive created is 22 bytes.
5. Save it or send it to a compteur.
6. Open it.

Expected behavior The archive should be larger. The archive should ask for a password. The archive should not be empty.

Smartphone (please complete the following information):

• Device: iPhone 12
• OS: iOS
• Version: 15.5

Additional context It used to work fine with my device. It is the first time I try export since iOS 15.5 and since Raivo OTP update 1.4.0.

Describe the bug The Ravio OTP IOS app crashes whenever I attempt to add a new code. To Reproduce Steps to reproduce the behavior:

1. Open any site you want to enable MFA for
2. Open the Ravio APP
3. Load the QR code
4. Click on save
5. the app crashes

Expected behavior I expect the app to save the code and not crash.

Screenshots N/A

Smartphone (please complete the following information):

• Device: Iphone 7
• OS: IOS 14.8
• Version: 18H17

Additional context Log file from 5 attempts 2021-10-07 13:43:42 global.initializeFileLogging():62 VERBOSE: File log destination initialized 2021-10-07 13:43:50 MainEntryViewController.tabBarController():62 VERBOSE: SearchStubController selectedIndex != 0 2021-10-07 13:43:55 global.initializeFileLogging():62 VERBOSE: File log destination initialized 2021-10-07 13:43:55 LoadEntryViewController.viewDidLoad():35 VERBOSE: Loading Raivo OTP 2021-10-07 13:43:55 LoadEntryViewController.viewDidLoad():58 VERBOSE: Got syncer account succesfully 2021-10-07 13:43:55 StateHelper.getCurrentState():94 VERBOSE: State: ENCRYPTION_KEY_UNKNOWN 2021-10-07 13:43:55 StateHelper.getCurrentState():94 VERBOSE: State: ENCRYPTION_KEY_UNKNOWN 2021-10-07 13:43:55 ApplicationDelegate.setCorrectStoryboard():158 VERBOSE: Changing Storyboard: Auth 2021-10-07 13:43:56 StorageHelper.setPasscodeTriedAmount():188 VERBOSE: Setting passcode tried amount 2021-10-07 13:43:56 StorageHelper.setPasscodeTriedTimestamp():207 VERBOSE: Setting passcode tried timestamp 2021-10-07 13:43:56 AuthEntryViewController.attemptBiometrickUnlock():222 VERBOSE: Unlocked app via biometric 2021-10-07 13:43:56 StateHelper.getCurrentState():98 VERBOSE: State: DATABASE_AND_ENCRYPTION_KEY_AVAILABLE 2021-10-07 13:43:56 StateHelper.getCurrentState():98 VERBOSE: State: DATABASE_AND_ENCRYPTION_KEY_AVAILABLE 2021-10-07 13:43:56 BaseSyncer.enable():40 VERBOSE: Enabling syncer 2021-10-07 13:43:56 CloudKitSyncer.enableAccountChangeListener():202 VERBOSE: Enabling account change listener 2021-10-07 13:43:56 ApplicationDelegate.setCorrectStoryboard():158 VERBOSE: Changing Storyboard: Main 2021-10-07 13:43:58 StateHelper.getCurrentState():98 VERBOSE: State: DATABASE_AND_ENCRYPTION_KEY_AVAILABLE 2021-10-07 13:43:58 StateHelper.getCurrentState():98 VERBOSE: State: DATABASE_AND_ENCRYPTION_KEY_AVAILABLE 2021-10-07 13:43:58 StateHelper.getCurrentState():98 VERBOSE: State: DATABASE_AND_ENCRYPTION_KEY_AVAILABLE 2021-10-07 13:43:58 StateHelper.getCurrentState():98 VERBOSE: State: DATABASE_AND_ENCRYPTION_KEY_AVAILABLE 2021-10-07 13:43:58 StateHelper.getCurrentState():98 VERBOSE: State: DATABASE_AND_ENCRYPTION_KEY_AVAILABLE 2021-10-07 13:43:58 StateHelper.getCurrentState():98 VERBOSE: State: DATABASE_AND_ENCRYPTION_KEY_AVAILABLE 2021-10-07 13:43:58 com.apple.cloudkit.operation-AFA4CEB3FB1EE4F5.callback StateHelper.getCurrentState():98 VERBOSE: State: DATABASE_AND_ENCRYPTION_KEY_AVAILABLE 2021-10-07 13:46:00 global.initializeFileLogging():62 VERBOSE: File log destination initialized 2021-10-07 13:46:00 LoadEntryViewController.viewDidLoad():35 VERBOSE: Loading Raivo OTP 2021-10-07 13:46:00 LoadEntryViewController.viewDidLoad():58 VERBOSE: Got syncer account succesfully 2021-10-07 13:46:00 StateHelper.getCurrentState():94 VERBOSE: State: ENCRYPTION_KEY_UNKNOWN 2021-10-07 13:46:00 StateHelper.getCurrentState():94 VERBOSE: State: ENCRYPTION_KEY_UNKNOWN 2021-10-07 13:46:00 ApplicationDelegate.setCorrectStoryboard():158 VERBOSE: Changing Storyboard: Auth 2021-10-07 13:46:01 StorageHelper.setPasscodeTriedAmount():188 VERBOSE: Setting passcode tried amount 2021-10-07 13:46:01 StorageHelper.setPasscodeTriedTimestamp():207 VERBOSE: Setting passcode tried timestamp 2021-10-07 13:46:01 AuthEntryViewController.attemptBiometrickUnlock():222 VERBOSE: Unlocked app via biometric 2021-10-07 13:46:01 StateHelper.getCurrentState():98 VERBOSE: State: DATABASE_AND_ENCRYPTION_KEY_AVAILABLE 2021-10-07 13:46:01 StateHelper.getCurrentState():98 VERBOSE: State: DATABASE_AND_ENCRYPTION_KEY_AVAILABLE 2021-10-07 13:46:01 BaseSyncer.enable():40 VERBOSE: Enabling syncer 2021-10-07 13:46:01 CloudKitSyncer.enableAccountChangeListener():202 VERBOSE: Enabling account change listener 2021-10-07 13:46:01 ApplicationDelegate.setCorrectStoryboard():158 VERBOSE: Changing Storyboard: Main 2021-10-07 13:46:02 com.apple.cloudkit.operation-AE9A9B2F58F63CC9.callback StateHelper.getCurrentState():98 VERBOSE: State: DATABASE_AND_ENCRYPTION_KEY_AVAILABLE 2021-10-07 13:46:03 StateHelper.getCurrentState():98 VERBOSE: State: DATABASE_AND_ENCRYPTION_KEY_AVAILABLE 2021-10-07 13:46:03 StateHelper.getCurrentState():98 VERBOSE: State: DATABASE_AND_ENCRYPTION_KEY_AVAILABLE 2021-10-07 13:46:03 StateHelper.getCurrentState():98 VERBOSE: State: DATABASE_AND_ENCRYPTION_KEY_AVAILABLE 2021-10-07 13:46:03 StateHelper.getCurrentState():98 VERBOSE: State: DATABASE_AND_ENCRYPTION_KEY_AVAILABLE 2021-10-07 13:46:03 StateHelper.getCurrentState():98 VERBOSE: State: DATABASE_AND_ENCRYPTION_KEY_AVAILABLE 2021-10-07 13:46:03 StateHelper.getCurrentState():98 VERBOSE: State: DATABASE_AND_ENCRYPTION_KEY_AVAILABLE 2021-10-07 13:49:10 global.initializeFileLogging():62 VERBOSE: File log destination initialized 2021-10-07 13:49:10 LoadEntryViewController.viewDidLoad():35 VERBOSE: Loading Raivo OTP 2021-10-07 13:49:10 LoadEntryViewController.viewDidLoad():58 VERBOSE: Got syncer account succesfully 2021-10-07 13:49:10 StateHelper.getCurrentState():94 VERBOSE: State: ENCRYPTION_KEY_UNKNOWN 2021-10-07 13:49:10 StateHelper.getCurrentState():94 VERBOSE: State: ENCRYPTION_KEY_UNKNOWN 2021-10-07 13:49:10 ApplicationDelegate.setCorrectStoryboard():158 VERBOSE: Changing Storyboard: Auth 2021-10-07 13:49:11 StorageHelper.setPasscodeTriedAmount():188 VERBOSE: Setting passcode tried amount 2021-10-07 13:49:11 StorageHelper.setPasscodeTriedTimestamp():207 VERBOSE: Setting passcode tried timestamp 2021-10-07 13:49:11 AuthEntryViewController.attemptBiometrickUnlock():222 VERBOSE: Unlocked app via biometric 2021-10-07 13:49:11 StateHelper.getCurrentState():98 VERBOSE: State: DATABASE_AND_ENCRYPTION_KEY_AVAILABLE 2021-10-07 13:49:11 StateHelper.getCurrentState():98 VERBOSE: State: DATABASE_AND_ENCRYPTION_KEY_AVAILABLE 2021-10-07 13:49:11 BaseSyncer.enable():40 VERBOSE: Enabling syncer 2021-10-07 13:49:11 CloudKitSyncer.enableAccountChangeListener():202 VERBOSE: Enabling account change listener 2021-10-07 13:49:11 ApplicationDelegate.setCorrectStoryboard():158 VERBOSE: Changing Storyboard: Main 2021-10-07 13:49:12 com.apple.cloudkit.operation-EE135B3615C88970.callback StateHelper.getCurrentState():98 VERBOSE: State: DATABASE_AND_ENCRYPTION_KEY_AVAILABLE 2021-10-07 13:51:55 global.initializeFileLogging():62 VERBOSE: File log destination initialized 2021-10-07 13:51:55 LoadEntryViewController.viewDidLoad():35 VERBOSE: Loading Raivo OTP 2021-10-07 13:51:55 LoadEntryViewController.viewDidLoad():58 VERBOSE: Got syncer account succesfully 2021-10-07 13:51:55 StateHelper.getCurrentState():94 VERBOSE: State: ENCRYPTION_KEY_UNKNOWN 2021-10-07 13:51:55 StateHelper.getCurrentState():94 VERBOSE: State: ENCRYPTION_KEY_UNKNOWN 2021-10-07 13:51:55 ApplicationDelegate.setCorrectStoryboard():158 VERBOSE: Changing Storyboard: Auth 2021-10-07 13:51:57 StorageHelper.setPasscodeTriedAmount():188 VERBOSE: Setting passcode tried amount 2021-10-07 13:51:57 StorageHelper.setPasscodeTriedTimestamp():207 VERBOSE: Setting passcode tried timestamp 2021-10-07 13:51:57 AuthEntryViewController.attemptBiometrickUnlock():222 VERBOSE: Unlocked app via biometric 2021-10-07 13:51:57 StateHelper.getCurrentState():98 VERBOSE: State: DATABASE_AND_ENCRYPTION_KEY_AVAILABLE 2021-10-07 13:51:57 StateHelper.getCurrentState():98 VERBOSE: State: DATABASE_AND_ENCRYPTION_KEY_AVAILABLE 2021-10-07 13:51:57 BaseSyncer.enable():40 VERBOSE: Enabling syncer 2021-10-07 13:51:57 CloudKitSyncer.enableAccountChangeListener():202 VERBOSE: Enabling account change listener 2021-10-07 13:51:57 ApplicationDelegate.setCorrectStoryboard():158 VERBOSE: Changing Storyboard: Main 2021-10-07 13:51:57 com.apple.cloudkit.operation-EDB10FEB6E7790B3.callback StateHelper.getCurrentState():98 VERBOSE: State: DATABASE_AND_ENCRYPTION_KEY_AVAILABLE 2021-10-07 13:52:04 global.initializeFileLogging():62 VERBOSE: File log destination initialized 2021-10-07 13:52:04 LoadEntryViewController.viewDidLoad():35 VERBOSE: Loading Raivo OTP 2021-10-07 13:52:04 LoadEntryViewController.viewDidLoad():58 VERBOSE: Got syncer account succesfully 2021-10-07 13:52:04 StateHelper.getCurrentState():94 VERBOSE: State: ENCRYPTION_KEY_UNKNOWN 2021-10-07 13:52:04 StateHelper.getCurrentState():94 VERBOSE: State: ENCRYPTION_KEY_UNKNOWN 2021-10-07 13:52:05 ApplicationDelegate.setCorrectStoryboard():158 VERBOSE: Changing Storyboard: Auth 2021-10-07 13:52:06 StorageHelper.setPasscodeTriedAmount():188 VERBOSE: Setting passcode tried amount 2021-10-07 13:52:06 StorageHelper.setPasscodeTriedTimestamp():207 VERBOSE: Setting passcode tried timestamp 2021-10-07 13:52:06 AuthEntryViewController.attemptBiometrickUnlock():222 VERBOSE: Unlocked app via biometric 2021-10-07 13:52:06 StateHelper.getCurrentState():98 VERBOSE: State: DATABASE_AND_ENCRYPTION_KEY_AVAILABLE 2021-10-07 13:52:06 StateHelper.getCurrentState():98 VERBOSE: State: DATABASE_AND_ENCRYPTION_KEY_AVAILABLE 2021-10-07 13:52:06 BaseSyncer.enable():40 VERBOSE: Enabling syncer 2021-10-07 13:52:06 CloudKitSyncer.enableAccountChangeListener():202 VERBOSE: Enabling account change listener 2021-10-07 13:52:06 ApplicationDelegate.setCorrectStoryboard():158 VERBOSE: Changing Storyboard: Main 2021-10-07 13:52:07 com.apple.cloudkit.operation-40E6B81E095B2D1C.callback StateHelper.getCurrentState():98 VERBOSE: State: DATABASE_AND_ENCRYPTION_KEY_AVAILABLE 2021-10-07 13:52:08 StateHelper.getCurrentState():98 VERBOSE: State: DATABASE_AND_ENCRYPTION_KEY_AVAILABLE 2021-10-07 13:52:08 StateHelper.getCurrentState():98 VERBOSE: State: DATABASE_AND_ENCRYPTION_KEY_AVAILABLE 2021-10-07 13:52:08 StateHelper.getCurrentState():98 VERBOSE: State: DATABASE_AND_ENCRYPTION_KEY_AVAILABLE 2021-10-07 13:52:08 StateHelper.getCurrentState():98 VERBOSE: State: DATABASE_AND_ENCRYPTION_KEY_AVAILABLE 2021-10-07 13:52:08 StateHelper.getCurrentState():98 VERBOSE: State: DATABASE_AND_ENCRYPTION_KEY_AVAILABLE 2021-10-07 13:52:08 StateHelper.getCurrentState():98 VERBOSE: State: DATABASE_AND_ENCRYPTION_KEY_AVAILABLE

A quick summary and/or background

I am not able to unencrypt the exported Raivo OTP backup on Windows 10 with 7-Zip

Steps to reproduce

1. Set up app
2. Export encrypted OTPs to iCloud
3. Extract successfully with password on iOS
4. Copy zip from iCloud to Windows
5. Extract with same (copied) password causes error on Windows

What you expected would happen

The .json and .html files are successfully extracted from the zip archive.

What actually happens

The .json and .html files are empty and an error is shown indicating a false password

Notes

Password is 32 characters and consists of ascii and special symbols \:<‘,/;

App version 1.4.3

When exporting OTPs to a ZIP archive the file is encrypted with the encryption password. The encryption method used is ZipCrypto, which basically is broken. Would it be possible to switch to AES-256?

Describe the bug If the master password contains the £ (British currency) character, 7-Zip fails to decrypt an encrypted data export from Raivo. The error message given by 7-Zip is simply "Wrong password". This is with the latest version of Windows 10 Pro 64-bit.

To Reproduce

1. Reset (or reinstall) Raivo.
2. Choose a master password which includes the £ symbol.
3. Acquire some OTPs.
4. Click on Settings, Export OTPs, Export, Mail
5. Send zip via email to Windows PC
6. Attempt to extract files from zip with 7-Zip using master password.
7. "Wrong password" error given by 7-zip.

Smartphone iPhone 7 iOS 14.7.1 (up to date)

Conjecture Could this arise because the £ symbol has different extended ASCII codes depending on which character set is being used? Maybe Raivo and 7-Zip employ different character sets? If so, other characters are likely to be affected. e.g. https://en.wikipedia.org/wiki/ISO/IEC_8859

I had no such trouble when including the & or ? characters (without £) in the master password. But these have ASCII codes under 128, so perhaps they are safer?

P.S. Apologies if you also get this bug notification on the Raivo Freshdesk site. I tried to submit it there a few days ago (as a guest, without registering), but was unable to create an account afterwards to check the ticket.

Is your feature request related to a problem? Please describe. Having a bunch of numbers on the screen is a distracting with my poor eyesight.

Describe the solution you'd like Removing any excess numbers would be very helpful. Adding an option to hide the previous token from the list and centering the current token would be much easier to read.

Describe alternatives you've considered Removing/hiding the previous token would be ideal, but if not an option then increasing the font size of the tokens might be a viable alternative.

Describe the bug Description says 'Optional FaceID or TouchID unlock. However, on iPhone XS the only option I have is to enable TouchID. Selecting this option asks for the iPhone PIN with iPhone XS. Deselecting does not provide an option for FaceID.

To Reproduce Steps to reproduce the behavior:

1. Go to 'Settings'
2. FaceID option is missing

Expected behavior The option for FaceID or TouchID should be relevant to the device which the application is running on. Devices that do not posses TouchID should not have the option, and vice-versa with FaceID.

https://developer.apple.com/documentation/localauthentication/logging_a_user_into_your_app_with_face_id_or_touch_id

Screenshots

Smartphone (please complete the following information):

• Device: iPhone XS
• OS: iOS 12.4
• Version: Raivo 0.0.10

Describe the bug One-time passwords not showing on Mac even when all the iCloud setting are set correctly and even when I linked the iOS app to Mac app correctly several times.

To Reproduce Steps to reproduce the behavior:

1. Go to 'Settings'
2. Click on 'Receivers'
3. Link Mac with scanning the QR code
4. Nothing happens on Mac

Expected behavior One-time passwords showing on Mac app

Smartphone (please complete the following information):

• Device: [iPhone12Pro]
• OS: [iOS15.6]
• Version [19G71]

Additional context Desktop

• Device: [MacBookAir(M1, 2020)]
• OS: [MacOSMonterey12.5]
• Version [21G72]

I could not find the ability to change the location of passwords in the application.

I want them to be moved up or down when I hold down the passwords. This feature is available in authy.

Can you do this to make the app better?

Is your feature request related to a problem? Please describe.

Nowadays hundreds of companies are adding support for physical security keys, the most secure methods of authentication to date. Being an owner of a few security keys, It would be beneficial for me to lock my OTP Management App with these keys.

Describe the solution you'd like

Add integration for FIDO U2F on macOS and iOS. More users will feel safer knowing only their key(s) will be able to open their app to gain access to the codes they need for logging into any account.

Describe alternatives you've considered

N/A

Additional context

Possibly add backup codes for the user to write down or even download in case they lost their security key.

Is your feature request related to a problem? Please describe. I have multiple entities I need to use 2FA for such as home, work, personal startup, etc... and currently I am using the same authenticator for all of them. It would be great to be able to have separate encryption keys for each of the entities so I can choose which accounts/vaults to import on a new device.

I was also affected by the LastPass breach where I stored my Raivo encryption key. To continue using Raivo I would have to perform multiple, time-consuming steps to update the 2FA for all of my accounts:

1. Install a different authenticator app
2. Update 2FA for all of my accounts on the new authenticator app
3. Sign out of Raivo
4. Delete the synchronisation file (not even sure how to do this)
5. Log in to Raivo
6. Create a new encryption password
7. Go back to update 2FA on all the previous sites with the new Raivo account

Describe the solution you'd like Allow users to create and manage additional accounts/vaults with separate encryption keys on the Raivo app. Users can open/collapse accounts/vaults in the Raivo app to reveal/hide TOTPs.

Describe alternatives you've considered I'm not aware of any other authenticator app that has this feature. The workarounds to this could be:

1. Install multiple authenticator apps each assigned to a separate entity. Kind of confusing to keep track of which authenticator app should be used when.
2. Switch to physical security keys, but same problem as above where it's confusing to keep track of in addition to the added inconvenience of carrying them around and risk of misplacing them.

Additional context This feature would also allow users to more easily migrate their existing TOTPs on Raivo to a new Raivo account in fewer steps. This would be particularly useful for users affected by data breaches such as the ones that occurred at LastPass in the past few months.

Is your feature request related to a problem? Please describe. As a family with multiple iOS devices and various accounts shared across family members, we need the ability to share TOTPs across those family members defined by our Apple account family organizer.

Describe the solution you'd like Upon a new installation, provide the ability to register the device with the family organizer. If approved, all devices would then sync their TOTP database across all approved devices. Also, as the family organizer, there should be the ability to remove devices (or other accounts within the family) from the sync.

Describe alternatives you've considered I am not aware of any other alternative (other than another authenticator app).

Is your feature request related to a problem? Please describe. This is not related to a problem. When using dark mode I find it harder to read the red font for the OTP codes.

Describe the solution you'd like It would be nice to have a color toggle for the OTP codes, to toggle from the red color to white or grey.

Describe alternatives you've considered Having a dark/ light theme toggle for the app specifically could alleviate the issue, without having to change the theme system wide.

Describe the bug When you migrate from Authy to Ravio following this link, the same QR codes will stick work with Authy. If Authy were to suffer from a breach like LastPass or if hacker tricks Authy customer agent then Ravio wouldn't help since the hacker can access user codes through Authy.

https://tij.me/blog/migrating-your-one-time-passwords-from-authy-to-raivo-otp/

To Reproduce Steps to reproduce the behavior:

1. Go to https://tij.me/blog/migrating-your-one-time-passwords-from-authy-to-raivo-otp/

Expected behavior The migration page should mention this danger and instead advocate users to create new tokens altogether instead of re-using the ones from Authy. When web applications create new tokens then the ones on Authy automatically expire and are no longer vulnerable.

Is your feature request related to a problem? Please describe. No, it's not related to a problem. I would like there to be optional periodic reminders asking you for your master password so that you can enter them which helps to remember the password. The reason is because I use a very strong and totally random master password that I memorize. However I need to constantly use it to recall it. I'm not willing to re-use a master password with other applications for obvious reasons so there needs to be a way for me remember it. Memory is safer than writing on paper which can get stolen or lost.

Describe the solution you'd like I would like for there to be an option to have periodic reminders to enter your master password so that you can remember it through re-use. It's optional so users can close out of the reminder when it pops up or change settings so that it doesn't pop up.

Describe alternatives you've considered An acceptable alternative is to have the user be given an option to enter the master password everytime on login. Although this is overkill, it would be acceptable for me.

Additional context Authy periodically asks for your master password when using the app so you keep it fresh in your head. Once you enter it in, you are either happy that you remembered your password or it's incorrect and you realize you'll need to get the password again