PyOTP 2.2.7__tar.gz → 2.2.8__tar.gz

{pyotp-2.2.7/src/pyotp.egg-info → pyotp-2.2.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 1.1
 Name: pyotp
-Version: 2.2.7
+Version: 2.2.8
 Summary: Python One Time Password Library
 Home-page: https://github.com/pyotp/pyotp
 Author: PyOTP contributors
@@ -29,14 +29,16 @@ Description: PyOTP - The Python One-Time Password Library
         - Deny replay attacks by rejecting one-time passwords that have been used by the client (this requires storing the most 
           recently authenticated timestamp, OTP, or hash of the OTP in your database, and rejecting the OTP when a match is seen)
         - Throttle brute-force attacks against your application's login functionality
-        - When implementing a "green field" application, consider supporting
-          `FIDO U2F <https://en.wikipedia.org/wiki/Universal_2nd_Factor>`_ in addition to HOTP/TOTP. U2F uses asymmetric
-          cryptography to avoid using a shared secret design, which strengthens your MFA solution against server-side compromise.
-          Hardware U2F also sequesters the client secret in a dedicated single-purpose device, which strengthens your clients
-          against client-side compromise.
+        - When implementing a "greenfield" application, consider supporting
+          `FIDO U2F <https://en.wikipedia.org/wiki/Universal_2nd_Factor>`_/`WebAuthn <https://www.w3.org/TR/webauthn/>`_ in
+          addition to HOTP/TOTP. U2F uses asymmetric cryptography to avoid using a shared secret design, which strengthens your
+          MFA solution against server-side attacks. Hardware U2F also sequesters the client secret in a dedicated single-purpose
+          device, which strengthens your clients against client-side attacks. And by automating scoping of credentials to
+          relying party IDs (application origin/domain names), U2F adds protection against phishing attacks. One implementation of
+          FIDO U2F/WebAuthn is PyOTP's sister project, `PyWARP <https://github.com/pyauth/pywarp>`_.
         
         We also recommend that implementers read the
-        `OWASP Authentication Cheat Sheet <https://www.owasp.org/index.php/Authentication_Cheat_Sheet>`_ and
+        `OWASP Authentication Cheat Sheet <https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md>`_ and
         `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_ for a high level overview of
         authentication best practices.
         
@@ -110,7 +112,7 @@ Description: PyOTP - The Python One-Time Password Library
         
         Scan the following barcode with your phone's OTP app (e.g. Google Authenticator):
         
-        .. image:: http://chart.apis.google.com/chart?cht=qr&chs=250x250&chl=otpauth%3A%2F%2Ftotp%2Falice%40google.com%3Fsecret%3DJBSWY3DPEHPK3PXP
+        .. image:: https://chart.apis.google.com/chart?cht=qr&chs=250x250&chl=otpauth%3A%2F%2Ftotp%2Falice%40google.com%3Fsecret%3DJBSWY3DPEHPK3PXP
         
         Now run the following and compare the output::
         
@@ -129,9 +131,14 @@ Description: PyOTP - The Python One-Time Password Library
         * `RFC 6238: TOTP: Time-Based One-Time Password Algorithm <https://tools.ietf.org/html/rfc6238>`_
         * `ROTP <https://github.com/mdp/rotp>`_ - Original Ruby OTP library by `Mark Percival <https://github.com/mdp>`_
         * `OTPHP <https://github.com/lelag/otphp>`_ - PHP port of ROTP by `Le Lag <https://github.com/lelag>`_
-        * `OWASP Authentication Cheat Sheet <https://www.owasp.org/index.php/Authentication_Cheat_Sheet>`_
+        * `OWASP Authentication Cheat Sheet <https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md>`_
         * `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_
         
+        For new applications:
+        
+        * `WebAuthn <https://www.w3.org/TR/webauthn/>`_
+        * `PyWARP <https://github.com/pyauth/pywarp>`_
+        
         .. image:: https://img.shields.io/travis/pyotp/pyotp.svg
                 :target: https://travis-ci.org/pyotp/pyotp
         .. image:: https://img.shields.io/codecov/c/github/pyotp/pyotp/master.svg
@@ -151,6 +158,8 @@ Classifier: Operating System :: MacOS :: MacOS X
 Classifier: Operating System :: POSIX
 Classifier: Programming Language :: Python
 Classifier: Programming Language :: Python :: 2.7
-Classifier: Programming Language :: Python :: 3.3
 Classifier: Programming Language :: Python :: 3.4
+Classifier: Programming Language :: Python :: 3.5
+Classifier: Programming Language :: Python :: 3.6
+Classifier: Programming Language :: Python :: 3.7
 Classifier: Topic :: Software Development :: Libraries :: Python Modules

{pyotp-2.2.7 → pyotp-2.2.8}/README.rst

@@ -21,14 +21,16 @@ minimum, application implementers should follow this checklist:
 - Deny replay attacks by rejecting one-time passwords that have been used by the client (this requires storing the most 
   recently authenticated timestamp, OTP, or hash of the OTP in your database, and rejecting the OTP when a match is seen)
 - Throttle brute-force attacks against your application's login functionality
-- When implementing a "green field" application, consider supporting
-  `FIDO U2F <https://en.wikipedia.org/wiki/Universal_2nd_Factor>`_ in addition to HOTP/TOTP. U2F uses asymmetric
-  cryptography to avoid using a shared secret design, which strengthens your MFA solution against server-side compromise.
-  Hardware U2F also sequesters the client secret in a dedicated single-purpose device, which strengthens your clients
-  against client-side compromise.
+- When implementing a "greenfield" application, consider supporting
+  `FIDO U2F <https://en.wikipedia.org/wiki/Universal_2nd_Factor>`_/`WebAuthn <https://www.w3.org/TR/webauthn/>`_ in
+  addition to HOTP/TOTP. U2F uses asymmetric cryptography to avoid using a shared secret design, which strengthens your
+  MFA solution against server-side attacks. Hardware U2F also sequesters the client secret in a dedicated single-purpose
+  device, which strengthens your clients against client-side attacks. And by automating scoping of credentials to
+  relying party IDs (application origin/domain names), U2F adds protection against phishing attacks. One implementation of
+  FIDO U2F/WebAuthn is PyOTP's sister project, `PyWARP <https://github.com/pyauth/pywarp>`_.
 
 We also recommend that implementers read the
-`OWASP Authentication Cheat Sheet <https://www.owasp.org/index.php/Authentication_Cheat_Sheet>`_ and
+`OWASP Authentication Cheat Sheet <https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md>`_ and
 `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_ for a high level overview of
 authentication best practices.
 
@@ -102,7 +104,7 @@ Working example
 
 Scan the following barcode with your phone's OTP app (e.g. Google Authenticator):
 
-.. image:: http://chart.apis.google.com/chart?cht=qr&chs=250x250&chl=otpauth%3A%2F%2Ftotp%2Falice%40google.com%3Fsecret%3DJBSWY3DPEHPK3PXP
+.. image:: https://chart.apis.google.com/chart?cht=qr&chs=250x250&chl=otpauth%3A%2F%2Ftotp%2Falice%40google.com%3Fsecret%3DJBSWY3DPEHPK3PXP
 
 Now run the following and compare the output::
 
@@ -121,9 +123,14 @@ Links
 * `RFC 6238: TOTP: Time-Based One-Time Password Algorithm <https://tools.ietf.org/html/rfc6238>`_
 * `ROTP <https://github.com/mdp/rotp>`_ - Original Ruby OTP library by `Mark Percival <https://github.com/mdp>`_
 * `OTPHP <https://github.com/lelag/otphp>`_ - PHP port of ROTP by `Le Lag <https://github.com/lelag>`_
-* `OWASP Authentication Cheat Sheet <https://www.owasp.org/index.php/Authentication_Cheat_Sheet>`_
+* `OWASP Authentication Cheat Sheet <https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md>`_
 * `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_
 
+For new applications:
+
+* `WebAuthn <https://www.w3.org/TR/webauthn/>`_
+* `PyWARP <https://github.com/pyauth/pywarp>`_
+
 .. image:: https://img.shields.io/travis/pyotp/pyotp.svg
         :target: https://travis-ci.org/pyotp/pyotp
 .. image:: https://img.shields.io/codecov/c/github/pyotp/pyotp/master.svg

{pyotp-2.2.7 → pyotp-2.2.8}/setup.py

@@ -7,7 +7,7 @@ install_requires = [line.rstrip() for line in open(os.path.join(os.path.dirname(
 
 setup(
     name="pyotp",
-    version="2.2.7",
+    version="2.2.8",
     url="https://github.com/pyotp/pyotp",
     license="MIT License",
     author="PyOTP contributors",
@@ -27,8 +27,10 @@ setup(
         "Operating System :: POSIX",
         "Programming Language :: Python",
         "Programming Language :: Python :: 2.7",
-        "Programming Language :: Python :: 3.3",
         "Programming Language :: Python :: 3.4",
+        "Programming Language :: Python :: 3.5",
+        "Programming Language :: Python :: 3.6",
+        "Programming Language :: Python :: 3.7",
         "Topic :: Software Development :: Libraries :: Python Modules"
     ]
 )

{pyotp-2.2.7 → pyotp-2.2.8}/src/pyotp/utils.py

@@ -106,4 +106,4 @@ def strings_equal(s1, s2):
     """
     s1 = unicodedata.normalize('NFKC', s1)
     s2 = unicodedata.normalize('NFKC', s2)
-    return compare_digest(s1, s2)
+    return compare_digest(s1.encode(), s2.encode())

{pyotp-2.2.7 → pyotp-2.2.8/src/pyotp.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 1.1
 Name: pyotp
-Version: 2.2.7
+Version: 2.2.8
 Summary: Python One Time Password Library
 Home-page: https://github.com/pyotp/pyotp
 Author: PyOTP contributors
@@ -29,14 +29,16 @@ Description: PyOTP - The Python One-Time Password Library
         - Deny replay attacks by rejecting one-time passwords that have been used by the client (this requires storing the most 
           recently authenticated timestamp, OTP, or hash of the OTP in your database, and rejecting the OTP when a match is seen)
         - Throttle brute-force attacks against your application's login functionality
-        - When implementing a "green field" application, consider supporting
-          `FIDO U2F <https://en.wikipedia.org/wiki/Universal_2nd_Factor>`_ in addition to HOTP/TOTP. U2F uses asymmetric
-          cryptography to avoid using a shared secret design, which strengthens your MFA solution against server-side compromise.
-          Hardware U2F also sequesters the client secret in a dedicated single-purpose device, which strengthens your clients
-          against client-side compromise.
+        - When implementing a "greenfield" application, consider supporting
+          `FIDO U2F <https://en.wikipedia.org/wiki/Universal_2nd_Factor>`_/`WebAuthn <https://www.w3.org/TR/webauthn/>`_ in
+          addition to HOTP/TOTP. U2F uses asymmetric cryptography to avoid using a shared secret design, which strengthens your
+          MFA solution against server-side attacks. Hardware U2F also sequesters the client secret in a dedicated single-purpose
+          device, which strengthens your clients against client-side attacks. And by automating scoping of credentials to
+          relying party IDs (application origin/domain names), U2F adds protection against phishing attacks. One implementation of
+          FIDO U2F/WebAuthn is PyOTP's sister project, `PyWARP <https://github.com/pyauth/pywarp>`_.
         
         We also recommend that implementers read the
-        `OWASP Authentication Cheat Sheet <https://www.owasp.org/index.php/Authentication_Cheat_Sheet>`_ and
+        `OWASP Authentication Cheat Sheet <https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md>`_ and
         `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_ for a high level overview of
         authentication best practices.
         
@@ -110,7 +112,7 @@ Description: PyOTP - The Python One-Time Password Library
         
         Scan the following barcode with your phone's OTP app (e.g. Google Authenticator):
         
-        .. image:: http://chart.apis.google.com/chart?cht=qr&chs=250x250&chl=otpauth%3A%2F%2Ftotp%2Falice%40google.com%3Fsecret%3DJBSWY3DPEHPK3PXP
+        .. image:: https://chart.apis.google.com/chart?cht=qr&chs=250x250&chl=otpauth%3A%2F%2Ftotp%2Falice%40google.com%3Fsecret%3DJBSWY3DPEHPK3PXP
         
         Now run the following and compare the output::
         
@@ -129,9 +131,14 @@ Description: PyOTP - The Python One-Time Password Library
         * `RFC 6238: TOTP: Time-Based One-Time Password Algorithm <https://tools.ietf.org/html/rfc6238>`_
         * `ROTP <https://github.com/mdp/rotp>`_ - Original Ruby OTP library by `Mark Percival <https://github.com/mdp>`_
         * `OTPHP <https://github.com/lelag/otphp>`_ - PHP port of ROTP by `Le Lag <https://github.com/lelag>`_
-        * `OWASP Authentication Cheat Sheet <https://www.owasp.org/index.php/Authentication_Cheat_Sheet>`_
+        * `OWASP Authentication Cheat Sheet <https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md>`_
         * `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_
         
+        For new applications:
+        
+        * `WebAuthn <https://www.w3.org/TR/webauthn/>`_
+        * `PyWARP <https://github.com/pyauth/pywarp>`_
+        
         .. image:: https://img.shields.io/travis/pyotp/pyotp.svg
                 :target: https://travis-ci.org/pyotp/pyotp
         .. image:: https://img.shields.io/codecov/c/github/pyotp/pyotp/master.svg
@@ -151,6 +158,8 @@ Classifier: Operating System :: MacOS :: MacOS X
 Classifier: Operating System :: POSIX
 Classifier: Programming Language :: Python
 Classifier: Programming Language :: Python :: 2.7
-Classifier: Programming Language :: Python :: 3.3
 Classifier: Programming Language :: Python :: 3.4
+Classifier: Programming Language :: Python :: 3.5
+Classifier: Programming Language :: Python :: 3.6
+Classifier: Programming Language :: Python :: 3.7
 Classifier: Topic :: Software Development :: Libraries :: Python Modules

{pyotp-2.2.7 → pyotp-2.2.8}/test.py

@@ -261,6 +261,9 @@ class StringComparisonTest(CompareDigestTest):
     def test_fullwidth_input(self):
         self.assertTrue(self.method("ｘs１２３45", "xs12345"))
 
+    def test_unicode_equal(self):
+        self.assertTrue(self.method("ěšč45", "ěšč45"))
+
 
 class CounterOffsetTest(unittest.TestCase):
     def test_counter_offset(self):