- Increased default secret key length from 16 to 32 characters for enhanced security
- Cryptographic entropy increased from 80 bits to 160 bits
- Maintains full compatibility with Google Authenticator and other TOTP apps
generateSecretKey()now generates 32-character secrets by default- To maintain previous behavior, use
generateSecretKey(16) - Updated tests to reflect new default behavior
- This change significantly improves security against brute force attacks
- 32-character secrets provide stronger cryptographic protection while maintaining RFC 6238 compliance
- Test using GitHub Actions
- Improve PHP 8.1 compatibility
- PHP 8 Support
- Tests
- Extract som test helpers
- PHPStan checks
- PHP required version bumped to >= 7.1
- Exception interfaces extending Throwable
- PHPStan checks
- Constants::ARGUMENT_NOT_SET - This is a BC break
- To fix inserted BC break
- To fix inserted BC break
- To fix inserted BC break
- Base exception class and interfaces
- Support for PHP 5.4 to 7.0, will keep supporting PHP 7.1, 7.2, 7.3 & 7.4
- Remove dead Google Charts API
- Bacon QRCode package removed
- Relicensed to MIT
- It's now mandatory to enable Google Api secret key access by executing
setAllowInsecureCallToGoogleApis(true);
- Fix Base32 to keep supporting PHP 5.4 && 5.5.
- Minor bugs
- Drop the Laravel support in favor of a bridge package (https://github.com/antonioribeiro/google2fa-laravel).
- Using a more secure Base 32 algorithm, to prevent cache-timing attacks.
- Added verifyKeyNewer() method to prevent reuse of keys.
- Refactored to remove complexity, by extracting support methods.
- Created a package playground page (https://pragmarx.com/google2fa)
- Drop the Laravel support in favor of a bridge package (https://github.com/antonioribeiro/google2fa-laravel).
- Using a more secure Base 32 algorithm, to prevent cache-timing attacks.
- Added verifyKeyNewer() method to prevent reuse of keys.
- Refactored to remove complexity, by extracting support methods.
- Created a package playground page (https://pragmarx.com/google2fa)
- Drop support for PHP 5.3.7, require PHP 5.4+.
- Coding style is now PSR-2 automatically enforced by StyleCI.
- Package bacon/bacon-qr-code was moved to "suggest".
- Allow paragonie/random_compat ~1.4|~2.0.
- Bumped christian-riesen/base32 to ~1.3
- Use paragonie/random_compat to generate cryptographically secure random secret keys
- Readme improvements
- Drop simple-qrcode in favor of bacon/bacon-qr-code
- Fix tavis setup for phpspec, PHP 7, hhvm and improve cache
- Fixed URL generation for QRCodes
- Avoid time attacks
- Laravel 5 compatibility.
- First version.