Skip to content

2.0.0

Latest
Latest
Compare
Choose a tag to compare
@markbao markbao released this 27 Jan 06:53
· 36 commits to master since this release
v2.0.0
4e0aa91

Speakeasy 2.0.0 is a major update based on a Speakeasy fork, Passcode, by Michael Phan-Ba, which also incorporates code from another Node.js HOTP/TOTP module, notp, by Guy Halford-Thompson, with additional functionality and API compatibility changes made by Mark Bao. Speakeasy is now also moving to its own GitHub organization.

Speakeasy 2.0.0 is API-compatible with Speakeasy 1.x.x, but a number of functions are renamed and deprecated for consistency. See below. Future versions of Speakeasy 2.x.x may not be API-compatible with Speakeasy 1.x.x. Deprecation notices have been added.

Added

  • Added support for SHA256 and SHA512 hashing algorithms, and general support for other hashing algorithms. Thanks, JHTWebAdmin.
  • Added verify functions from notp, adding verification window functionality which allows for the verification of tokens across a window (e.g. in HOTP, x tokens ahead, or in TOTP, x tokens ahead or behind).
  • Added verifyDelta functions which calculate a delta between a given token and where it was found within the window.
  • Added verify functions which wrap verifyDelta to return a boolean.
  • Added tests for key generator.
  • Added many more tests from Passcode and notp. All the above thanks to work from mikepb, guyht, and markbao.
  • Added issuer, counter, and type to Google Authenticator otpauth:// URL. Thanks, Vincent Lombard.
  • Added the output of a Google Authenticator–compatible otpauth:// URL to the key generator.
  • Added a new function, otpuathURL(), to output an otpauth:// URL.
  • Added a new demo and a guide for how to use Speakeasy to implement two-factor authentication.
  • Added code coverage testing with Istanbul.
  • Now conforms to JavaScript Semistandard code style.

API Changes

v2.0.0 does not introduce any breaking changes, but deprecates a number of functions and parameters. Backwards compatibility is maintained for v2.0.0 but may not be maintained for future versions. While we highly recommend updating to 2.x.x, please make sure to update your package.json to use Speakeasy at versions ^1.0.5 if you'd like to use the 1.x.x API.

  • generate_key() is now generateSecret(). generate_key() deprecated.
  • generate_key_ascii() is now generateSecretASCII(). generate_key_ascii() deprecated.
  • totp() and hotp() now take the key parameter as secret (key deprecated).
  • totp() and hotp() now take the length parameter as digits (length deprecated).
  • totp() now takes the initial_time parameter as epoch (initial_time deprecated).
  • generateSecret() no longer supports returning URLs to QR codes using qr_codes and google_auth_qr since passing the secret to a third party may be a security risk. Implement QR code generation on your own instead, such as by using a QR module like qr-image or node-qrcode.

Changed

  • Now uses native Node.js buffers for converting encodings.
  • Now uses base32.js Node package for base32 conversions.
  • Moved location of main file to index.js.
  • Moved digesting into a separate function.
  • Documentation now uses JSDoc.

Fixed

  • Double-escape otpauth:// parameters for Google Authenticator otpauth:// URL. Thanks, cgarvey.
Assets 2
Loading