update docs

README.md

@@ -12,12 +12,16 @@ A native Android client for Maldivian banking services. It is a pure client: req
 
 - Android 8.0+ (API 26)
 - Existing accounts with MIB, BML, or Fahipay
-- Your TOTP seed (base32 secret from your authenticator app setup) for each bank
+- Your TOTP seed (base32 secret from your authenticator app setup) for each bank. See [how to get your TOTP seed](docs/thijooree/faq/totpseed/README.md)
 
 ## Download APK
 [Gitea Releases](https://git.shihaam.dev/shihaam/thijooree/releases)
 [Telegram Channel](https://t.me/s/thijooreeapks)
 
+## FAQ
+
+Common questions and setup guides are in the [FAQ](docs/thijooree/faq/README.md).
+
 ## Privacy
 
 No data ever leaves your device except the API calls to the banking services themselves. See the [security audit](docs/thijooree/AI_SECURITY_CHECK.md) for a full list of every server the app connects to.

docs/thijooree/faq/README.md

@@ -0,0 +1,3 @@
+# FAQ
+
+## [What is and how do i get my TOTP Seed?](totpseed/README.md)

docs/thijooree/faq/totpseed/01-setup-bml.md

@@ -0,0 +1,87 @@
+# Set up BML
+
+Reset your Bank of Maldives authenticator to get a new OTP seed, then add that seed to Thijooree so it can generate your OTP codes.
+
+> [!NOTE]
+> You need the BML app signed in, and a BML debit card with its expiry date and CVC to confirm who you are.
+
+> [!IMPORTANT]
+> Want the same codes in another authenticator app too, such as Microsoft Authenticator or Google Authenticator? Add the secret key to that app **after step 5 and before step 7**. After you tap **Verify Code**, BML stops showing the secret key and you would have to reset again. See [Export from Microsoft Authenticator](04-export-microsoft.md) for the steps.
+
+<table>
+  <tr>
+    <th width="25%">Step 1</th>
+    <th width="25%">Step 2</th>
+    <th width="25%">Step 3</th>
+    <th width="25%">Step 4</th>
+  </tr>
+  <tr>
+    <td align="center"><img src="screenshots/bml_1.jpg" alt="BML app wallet screen with the profile icon highlighted" width="200"></td>
+    <td align="center"><img src="screenshots/bml_2.jpg" alt="Profile menu with Authenticator Setup highlighted" width="200"></td>
+    <td align="center"><img src="screenshots/bml_3.jpg" alt="Channel Settings screen with the Reset Authenticator button highlighted" width="200"></td>
+    <td align="center"><img src="screenshots/bml_4.jpg" alt="Debit card verification form with the Authorize button highlighted" width="200"></td>
+  </tr>
+  <tr>
+    <td valign="top">
+      <b>Open your profile</b><br>
+      In the BML app, tap the <b>profile icon</b> in the top-right corner of the Wallet screen.
+    </td>
+    <td valign="top">
+      <b>Open Authenticator Setup</b><br>
+      In the menu, under <b>Settings</b>, tap <b>Authenticator Setup</b>.
+    </td>
+    <td valign="top">
+      <b>Reset the authenticator</b><br>
+      On the <b>Security</b> tab, tap <b>Reset Authenticator</b>. This replaces any authenticator app you used before.
+    </td>
+    <td valign="top">
+      <b>Verify your debit card</b><br>
+      Pick a debit card, enter its expiry month, expiry year and CVC, then tap <b>Authorize</b>.
+    </td>
+  </tr>
+  <tr>
+    <th>Step 5</th>
+    <th>Step 6</th>
+    <th>Step 7</th>
+    <th>Done</th>
+  </tr>
+  <tr>
+    <td align="center"><img src="screenshots/bml_5.jpg" alt="QR code screen with the copy button next to the secret key highlighted" width="200"></td>
+    <td align="center"><img src="screenshots/thijooree_1.jpg" alt="Thijooree sign-in screen with the OTP seed filled in and the current OTP shown" width="200"></td>
+    <td align="center"><img src="screenshots/bml_6.jpg" alt="BML screen with the OTP entered and the Verify Code button highlighted" width="200"></td>
+    <td align="center"><img src="screenshots/bml_7.jpg" alt="Authenticator reset successfully message" width="200"></td>
+  </tr>
+  <tr>
+    <td valign="top">
+      <b>Copy the secret key</b><br>
+      Below the QR code, tap the <b>copy button</b> next to the secret key. Keep this screen open, you will come back to it.
+    </td>
+    <td valign="top">
+      <b>Add the seed to Thijooree</b><br>
+      Open Thijooree and paste the key into <b>OTP Seed (TOTP Secret)</b>. Tap the <b>Current OTP</b> box to copy the 6-digit code.<br><br>
+      <i>Adding the key to another authenticator app? Do it now, before step 7.</i>
+    </td>
+    <td valign="top">
+      <b>Verify the code in BML</b><br>
+      Go back to the BML app, paste the code into the 6-digit code field and tap <b>Verify Code</b>.
+    </td>
+    <td valign="top">
+      <b>All done</b><br>
+      BML shows <b>Authenticator reset successfully</b>. Thijooree now generates your BML OTP codes.
+    </td>
+  </tr>
+</table>
+
+## Log in to Thijooree
+
+Once BML shows **Authenticator reset successfully**, go back to Thijooree:
+
+1. Enter your BML **Username** and **Password**.
+2. Check that **OTP Seed (TOTP Secret)** still has the key you pasted in step 6.
+3. Tap **Login**.
+
+> [!TIP]
+> The OTP changes every 30 seconds. If BML rejects the code, copy the current one from Thijooree again and verify straight away.
+
+> [!WARNING]
+> The secret key gives full access to your OTP codes. Don't share it or screenshot it where others can see it.

docs/thijooree/faq/totpseed/02-setup-mib.md

@@ -0,0 +1,39 @@
+# Set up MIB
+
+Maldives Islamic Bank doesn't let you reset your authenticator from the app. The only way to get a new OTP seed is to ask customer care, and then wait. And wait some more.
+
+> [!NOTE]
+> You need patience, a working email address and a small amount of faith. Results may vary.
+
+## How to do it
+
+1. **Contact customer care**<br>
+   Get in touch with MIB customer care and ask them to reset your authenticator and send you a new secret key.
+
+2. **Perform the summoning ritual**<br>
+   Light a candle, face the direction of the nearest MIB branch and chant *"please reply, please reply"* three times. Offering a cup of tea to the ticket gods is optional but recommended.
+
+3. **Wait for the email**<br>
+   MIB emails you the new secret key. Eventually. Check your inbox, then check your spam folder, then check your inbox again.
+
+4. **Wait more**<br>
+   Still nothing? This is normal. Refresh your inbox. Touch grass. Refresh your inbox again.
+
+5. **Perform another ritual**<br>
+   Repeat step 2, but with two candles this time. If it has been a few working days, a polite follow-up to customer care also works, and is less of a fire hazard.
+
+6. **Add the seed to Thijooree**<br>
+   Once the email arrives, copy the secret key from it. Open Thijooree, go to the **faisanet** sign-in screen and paste the key into **OTP Seed (TOTP Secret)**. The **Current OTP** appears below it.
+
+## Log in to Thijooree
+
+Once the key is in, in Thijooree:
+
+1. Enter your MIB **Username** and **Password**.
+2. Tap **Login**.
+
+> [!TIP]
+> Already have your MIB account in Google Authenticator or Bitwarden? Skip the rituals entirely and see [Export from Google Authenticator](03-export-googleauthenticator.md) or [Export from Bitwarden](05-export-bitwarden.md).
+
+> [!WARNING]
+> The secret key gives full access to your OTP codes. Don't share it, and delete the email once you have logged in.

docs/thijooree/faq/totpseed/03-export-googleauthenticator.md

@@ -0,0 +1,107 @@
+# Export from Google Authenticator
+
+Google Authenticator can export your accounts as a QR code. Take a screenshot of that QR code and load it into Thijooree to get the same OTP seed, without resetting anything with your bank.
+
+> [!NOTE]
+> Exporting doesn't change your seed. Google Authenticator keeps working, and it shows the same codes as Thijooree.
+
+> [!IMPORTANT]
+> Thijooree holds one seed per login. In step 3, select **only** the bank account you want to log in to on Thijooree.
+
+<table>
+  <tr>
+    <th width="25%">Step 1</th>
+    <th width="25%">Step 2</th>
+    <th width="25%">Step 3</th>
+    <th width="25%">Step 4</th>
+  </tr>
+  <tr>
+    <td align="center"><img src="screenshots/google_1.jpg" alt="Google Authenticator home screen with the menu button highlighted" width="200"></td>
+    <td align="center"><img src="screenshots/google_2.jpg" alt="Google Authenticator menu with Transfer codes highlighted" width="200"></td>
+    <td align="center"><img src="screenshots/google_3.jpg" alt="Select codes screen with only MIB checked and the Next button highlighted" width="200"></td>
+    <td align="center"><img src="screenshots/google_4.jpg" alt="Scan this QR code screen showing the export QR code" width="200"></td>
+  </tr>
+  <tr>
+    <td valign="top">
+      <b>Open the menu</b><br>
+      In Google Authenticator, tap the <b>menu button</b> (three lines) in the top-left corner.
+    </td>
+    <td valign="top">
+      <b>Open Transfer codes</b><br>
+      Tap <b>Transfer codes</b>.
+    </td>
+    <td valign="top">
+      <b>Select your bank account</b><br>
+      Check <b>only</b> the bank account you want to log in to on Thijooree, then tap <b>Next</b>.
+    </td>
+    <td valign="top">
+      <b>Screenshot the QR code</b><br>
+      Take a <b>screenshot</b> of the QR code. Keep this screen open, you will come back to it.
+    </td>
+  </tr>
+  <tr>
+    <th>Step 5</th>
+    <th>Step 6</th>
+    <th>Step 7</th>
+    <th>Step 8</th>
+  </tr>
+  <tr>
+    <td align="center"><img src="screenshots/thijooree_2.jpg" alt="Thijooree sign-in screen with the QR button next to the OTP seed field highlighted" width="200"></td>
+    <td align="center"><img src="screenshots/thijooree_3.jpg" alt="Thijooree QR scanner with the Pick image button highlighted" width="200"></td>
+    <td align="center"><img src="screenshots/thijooree_4.jpg" alt="Photo picker with the QR code screenshot selected" width="200"></td>
+    <td align="center"><img src="screenshots/google_5.jpg" alt="Google Authenticator Scan this QR code screen with the Next button highlighted" width="200"></td>
+  </tr>
+  <tr>
+    <td valign="top">
+      <b>Open the QR scanner</b><br>
+      Open Thijooree and, on the sign-in screen, tap the <b>QR button</b> next to <b>OTP Seed (TOTP Secret)</b>.
+    </td>
+    <td valign="top">
+      <b>Pick an image</b><br>
+      The QR code is on the same phone, so there is nothing to scan. Tap <b>Pick image</b>.
+    </td>
+    <td valign="top">
+      <b>Select the screenshot</b><br>
+      Select the QR code screenshot from step 4. Thijooree fills in the OTP seed for you.
+    </td>
+    <td valign="top">
+      <b>Finish the export</b><br>
+      Go back to Google Authenticator and tap <b>Next</b> on the QR code screen.
+    </td>
+  </tr>
+  <tr>
+    <th>Step 9</th>
+    <th colspan="2">Step 10</th>
+    <th></th>
+  </tr>
+  <tr>
+    <td align="center"><img src="screenshots/google_6.jpg" alt="Remove your exported codes screen with Keep exported codes and Done highlighted" width="200"></td>
+    <td align="center"><img src="screenshots/google_7.jpg" alt="Google Authenticator list with the MIB code highlighted" width="200"></td>
+    <td align="center"><img src="screenshots/thijooree_5.jpg" alt="Thijooree sign-in screen with the Current OTP highlighted, matching Google Authenticator" width="200"></td>
+    <td></td>
+  </tr>
+  <tr>
+    <td valign="top">
+      <b>Keep the exported codes</b><br>
+      Select <b>Keep exported codes</b> and tap <b>Done</b>. Don't remove them, or the account disappears from Google Authenticator.
+    </td>
+    <td valign="top" colspan="2">
+      <b>Check that the codes match</b><br>
+      Compare the <b>Current OTP</b> in Thijooree with the code for the same account in Google Authenticator. They should be the same, because both use the same seed.
+    </td>
+    <td></td>
+  </tr>
+</table>
+
+## Log in to Thijooree
+
+Once the codes match, in Thijooree:
+
+1. Enter your bank **Username** and **Password**.
+2. Tap **Login**.
+
+> [!TIP]
+> The OTP changes every 30 seconds. If the codes don't match, wait for both to refresh and compare again. If they still differ, go back to step 3 and check you selected the right account.
+
+> [!WARNING]
+> The QR code screenshot holds your OTP seed. Delete it from your phone, and from any cloud photo backup, once you have logged in.

docs/thijooree/faq/totpseed/04-export-microsoft.md

@@ -0,0 +1,62 @@
+# Export from Microsoft Authenticator
+
+Microsoft Authenticator can't export TOTP seeds unless your phone is rooted, so you can't move an existing seed out of it.
+
+Instead, reset your OTP seed with your bank to get a new secret key. Add that key to Thijooree, and to Microsoft Authenticator too if you want codes in both apps.
+
+> [!IMPORTANT]
+> Resetting replaces the old seed. The existing BML entry in Microsoft Authenticator stops working, so you have to add the new key to it again.
+
+## How to do it
+
+1. Follow [Set up BML](01-setup-bml.md) up to **step 5**, where you copy the secret key.
+2. Add the key to Microsoft Authenticator using the steps below.
+3. Go back to [Set up BML](01-setup-bml.md) and continue from **step 6**.
+
+> [!WARNING]
+> Add the key to Microsoft Authenticator **before step 7** (Verify Code). After you verify, BML stops showing the secret key and you would have to reset again.
+
+## Add the key to Microsoft Authenticator
+
+<table>
+  <tr>
+    <th width="20%">Step 1</th>
+    <th width="20%">Step 2</th>
+    <th width="20%">Step 3</th>
+    <th width="20%">Step 4</th>
+    <th width="20%">Done</th>
+  </tr>
+  <tr>
+    <td align="center"><img src="screenshots/msauth_1.jpg" alt="Microsoft Authenticator home screen with the QR code button highlighted" width="160"></td>
+    <td align="center"><img src="screenshots/msauth_2.jpg" alt="Scan QR Code screen with the Enter code manually button highlighted" width="160"></td>
+    <td align="center"><img src="screenshots/msauth_3.jpg" alt="Add account screen with Other account highlighted" width="160"></td>
+    <td align="center"><img src="screenshots/msauth_4.jpg" alt="Add account form with account name and secret key filled in" width="160"></td>
+    <td align="center"><img src="screenshots/msauth_5.jpg" alt="Bank of Maldives account in the Microsoft Authenticator list showing a 6-digit code" width="160"></td>
+  </tr>
+  <tr>
+    <td valign="top">
+      <b>Add an account</b><br>
+      Open Microsoft Authenticator and tap the <b>QR code button</b> in the bottom-right corner.
+    </td>
+    <td valign="top">
+      <b>Enter the code manually</b><br>
+      BML is on the same phone, so there is nothing to scan. Tap <b>Enter code manually</b>.
+    </td>
+    <td valign="top">
+      <b>Choose the account type</b><br>
+      Tap <b>Other account (Google, Facebook, etc.)</b>.
+    </td>
+    <td valign="top">
+      <b>Paste the secret key</b><br>
+      Enter an <b>Account Name</b> such as <i>Bank of Maldives</i>, paste the key from BML into <b>Secret Key</b> and tap <b>Finish</b>.
+    </td>
+    <td valign="top">
+      <b>Account added</b><br>
+      The account now shows a 6-digit code. It matches the code in Thijooree because both use the same key.
+    </td>
+  </tr>
+</table>
+
+Now go back to [Set up BML](01-setup-bml.md) and continue from **step 6**. In step 7 you can verify with the code from either Thijooree or Microsoft Authenticator.
+
+For MIB, see [Set up MIB](02-setup-mib.md).

docs/thijooree/faq/totpseed/05-export-bitwarden.md

@@ -0,0 +1,52 @@
+# Export from Bitwarden
+
+Bitwarden stores the authenticator key of a login in plain text. Copy it from the login's edit screen and paste it into Thijooree to get the same OTP seed, without resetting anything with your bank.
+
+> [!NOTE]
+> Copying the key doesn't change your seed. Bitwarden keeps working, and it shows the same codes as Thijooree.
+
+<table>
+  <tr>
+    <th width="25%">Step 1</th>
+    <th width="25%">Step 2</th>
+    <th width="25%">Step 3</th>
+    <th width="25%">Step 4</th>
+  </tr>
+  <tr>
+    <td align="center"><img src="screenshots/bitwarden_1.jpg" alt="Bitwarden View login screen for Bank of Maldives with the edit button highlighted" width="200"></td>
+    <td align="center"><img src="screenshots/bitwarden_2.jpg" alt="Bitwarden Edit login screen with the copy button next to the Authenticator key highlighted" width="200"></td>
+    <td align="center"><img src="screenshots/thijooree_6.jpg" alt="Thijooree sign-in screen with the OTP seed filled in and the current OTP shown" width="200"></td>
+    <td align="center"><img src="screenshots/bitwarden_3.jpg" alt="Bitwarden View login screen with the Authenticator key code highlighted, matching Thijooree" width="200"></td>
+  </tr>
+  <tr>
+    <td valign="top">
+      <b>Edit your bank login</b><br>
+      In Bitwarden, open the login for your bank and tap the <b>edit button</b> in the bottom-right corner.
+    </td>
+    <td valign="top">
+      <b>Copy the authenticator key</b><br>
+      Tap the <b>copy button</b> next to <b>Authenticator key</b>.
+    </td>
+    <td valign="top">
+      <b>Add the seed to Thijooree</b><br>
+      Open Thijooree and paste the key into <b>OTP Seed (TOTP Secret)</b>. The <b>Current OTP</b> appears below it.
+    </td>
+    <td valign="top">
+      <b>Check that the codes match</b><br>
+      Go back to Bitwarden, close the edit screen without saving and compare the <b>Authenticator key</b> code with the <b>Current OTP</b> in Thijooree. They should be the same, because both use the same seed.
+    </td>
+  </tr>
+</table>
+
+## Log in to Thijooree
+
+Once the codes match, in Thijooree:
+
+1. Enter your bank **Username** and **Password**.
+2. Tap **Login**.
+
+> [!TIP]
+> The OTP changes every 30 seconds. If the codes don't match, wait for both to refresh and compare again. If they still differ, copy the key from Bitwarden again and make sure you opened the right login.
+
+> [!WARNING]
+> The authenticator key gives full access to your OTP codes. Don't share it or paste it anywhere else.

docs/thijooree/faq/totpseed/README.md

@@ -0,0 +1,27 @@
+# TOTP Seed
+
+## What is a TOTP seed?
+
+A TOTP (Time-based One-Time Password) seed is the secret key your bank gives you when you set up its authenticator. It looks like a string of capital letters and numbers such as `JBSWY3DPEHPK3PXP`, or comes inside a QR code as an `otpauth://` link.
+
+## Thijooree needs the seed to: 
+- Enable OTP-less Transactions.
+- Show your OTP codes (to use official bank app or website along with Thijooree.)
+
+To keep transactions secure, you can have Thijooree ask for your biometrics instead of an OTP. \
+Keep your seed private: anyone who has it can make your OTP codes.
+
+## How do I get my TOTP seed?
+
+You get your seed in one of two ways:
+
+### Setup
+
+1. [Set up BML](01-setup-bml.md)
+2. [Set up MIB](02-setup-mib.md)
+
+### Export
+
+3. [Export from Google Authenticator](03-export-googleauthenticator.md)
+4. [Export from Microsoft Authenticator](04-export-microsoft.md)
+5. [Export from Bitwarden](05-export-bitwarden.md)