Google2Fa Laravel Package

Added

• Test using GitHub Actions

Fixed

• Improve PHP 8.1 compatibility

Added

• PHP 8 Support
• Tests
• Extract som test helpers
• PHPStan checks

Changed

• PHP required version bumped to >= 7.1
• Exception interfaces extending Throwable

Added

• PHPStan checks

Removed

• Constants::ARGUMENT_NOT_SET - This is a BC break

Drafted

• To fix inserted BC break

DELETED

• To fix inserted BC break

DELETED

• To fix inserted BC break

Added

• Base exception class and interfaces

Removed

• Support for PHP 5.4 to 7.0, will keep supporting PHP 7.1, 7.2, 7.3 & 7.4

Changed

• Remove dead Google Charts API

Changed

• Bacon QRCode package removed

Changed

• Relicensed to MIT

Changed

• It's now mandatory to enable Google Api secret key access by executing setAllowInsecureCallToGoogleApis(true);

Fixed

• Fix Base32 to keep supporting PHP 5.4 && 5.5.

Fixed

• Minor bugs

Changed

• Drop the Laravel support in favor of a bridge package (https://github.com/antonioribeiro/google2fa-laravel).
• Using a more secure Base 32 algorithm, to prevent cache-timing attacks.
• Added verifyKeyNewer() method to prevent reuse of keys.
• Refactored to remove complexity, by extracting support methods.
• Created a package playground page (https://pragmarx.com/google2fa)

Changed

• Drop support for PHP 5.3.7, require PHP 5.4+.
• Coding style is now PSR-2 automatically enforced by StyleCI.

Changed

• Package bacon/bacon-qr-code was moved to "suggest".

Fixed

• Allow paragonie/random_compat ~1.4|~2.0.

Changed

• Bumped christian-riesen/base32 to ~1.3
• Use paragonie/random_compat to generate cryptographically secure random secret keys
• Readme improvements
• Drop simple-qrcode in favor of bacon/bacon-qr-code
• Fix tavis setup for phpspec, PHP 7, hhvm and improve cache

Changed

• Fixed URL generation for QRCodes
• Avoid time attacks

Changed

• Laravel 5 compatibility.

Added

• First version.

⚠️ Breaking Change

Added

• Increased default secret key length from 16 to 32 characters for enhanced security
• Cryptographic entropy increased from 80 bits to 160 bits
• Maintains full compatibility with Google Authenticator and other TOTP apps

Changed

• generateSecretKey() now generates 32-character secrets by default
• To maintain previous behavior, use generateSecretKey(16)
• Updated tests to reflect new default behavior

Security

• This change significantly improves security against brute force attacks
• 32-character secrets provide stronger cryptographic protection while maintaining RFC 6238 compliance