forked from thijooree/android
63 lines
1.6 KiB
Markdown
63 lines
1.6 KiB
Markdown
# OTP Screen
|
|
|
|
Displays the current TOTP (Time-based One-Time Password) code for each enrolled bank authenticator. Used when confirming transfers, QR payments, or other 2FA-protected operations.
|
|
|
|
---
|
|
|
|
## Fragment — `OtpFragment`
|
|
|
|
Hosts one card per enrolled bank authenticator. Banks with no stored TOTP seed are not shown.
|
|
|
|
---
|
|
|
|
## TOTP Display
|
|
|
|
Each card shows:
|
|
- Bank logo and name
|
|
- The current 6-digit TOTP code (large text)
|
|
- A circular countdown ring showing time remaining in the current 30-second window
|
|
- The code refreshes automatically when the window expires — no user interaction needed
|
|
|
|
### Algorithm
|
|
|
|
Standard RFC 6238 TOTP:
|
|
- Hash: SHA-1
|
|
- Window: 30 seconds
|
|
- Digits: 6
|
|
- Seed: stored per-bank in `CredentialStore` (encrypted)
|
|
|
|
---
|
|
|
|
## Supported Banks
|
|
|
|
| Bank | Seed source |
|
|
|---|---|
|
|
| BML | Enrolled via BML app setup; seed stored in `CredentialStore` |
|
|
| MIB | MIB business/corporate OTP seed (if applicable) |
|
|
|
|
---
|
|
|
|
## Background Name Refresh
|
|
|
|
When the screen opens, the fragment may fire a background API call to refresh the account holder name associated with each seed. This is a best-effort call — failure does not affect OTP display.
|
|
|
|
---
|
|
|
|
## Usage
|
|
|
|
The OTP screen is informational — the user copies the displayed code manually and enters it wherever required (e.g., in `TransferFragment`'s OTP dialog, or in an external portal). The code is never submitted automatically from this screen.
|
|
|
|
---
|
|
|
|
## Security
|
|
|
|
The TOTP seeds are stored encrypted in `CredentialStore`. They are never logged or included in error reports.
|
|
|
|
---
|
|
|
|
|
|
|
|
---
|
|
|
|
[← Activities](09-activities.md) **Next →** [PayMV QR Screen](11-paymv-qr-screen.md)
|