1
Feature Request — Yandex 2FA (yaotp scheme)
Source: dani-garcia/vaultwarden#7302 · opened by @lapytko
Summary Add support for Yandex's proprietary OTP scheme (yaotp), which is not compatible with standard TOTP (RFC 6238). The differences are fundamental: the output is 8 lowercase letters (not digits), the HMAC key is derived by hashing PIN ‖ secret via SHA-256, and the final code is base-26 encoded. A standard TOTP library cannot produce correct Yandex OTPs without a dedicated implementation. --- URI Format Yandex Authenticator exports the following URI scheme when scanning a QR code from Yandex ID: Real-world example (redacted) URI field reference | Field | Value (example) | Meaning | |---|---|---| | scheme | yaotp | Not totp — requires separate parser branch | | secret | CZJSEQFM2EQCT2CAKPSUSDHZNY | Base32-encoded 16-byte TOTP seed | | pin | 244277 | Numeric PIN, present in plaintext in the URI | | pin_length | 6 | Must match len(pin) — validate on import | | length | 8 | OTP output length in characters | | chars | alpha | Output charset: low…
No pledges yet. Be the first to back this.
Comments
Similar requests
Additional configuration for hardening 2FA
2 votes · 0 comments
Disable 2FA email setup button if email 2FA is disabled in admin settings
1 vote · 0 comments
2FA for web extension
2 votes · 0 comments
Default 2FA email for new users invited to organizations with 2FA-policy enabled
11 votes · 0 comments
Show notification and force if 2FA is required when first login
1 vote · 0 comments
No comments yet.