Momentum-Apps/FAQ

# Frequently asked questions

## Is it secure?

Flipper Authenticator stores token secrets in config file in encrypted form. Encryption is done using standard Flipper Zero API, which states that it is using AES encryption with built-in into flipper secret key and initialization vector (IV) generated by the app at initial setup XOR-ed by user's PIN (or Flipper UID, if PIN not setup by user).

So in theory to get plain token secret it is necessary to have original Flipper Zero device where config file was generated and know user's PIN (if user setup PIN).

If user provides plain token secret manually straight to a config file, once app will be launched it will detect plain token, will encrypt it and will replace plain token secret with encrypted copy.

Let me know if you have an ideas of how we can make Flipper Authenticator even more secure.

## How to get it?

If you don't want to build the app yourself then just pull FAP file from [latest release](https://github.com/akopachov/flipper-zero_authenticator/releases) and put it to your Flipper Zero device by copying it to `/ext/apps/Misc`. After that you should be able to run it on your Flipper.

## How to build it?

Pull the repo with recursive submodule initialization and then run `./build.ps1` command to build the app. Once done FAP files will be available in the `build` directory.

## Where is config file?

At first start app will create new config file (default location is [`/ext/apps/Misc/totp.conf`](https://github.com/akopachov/flipper-zero_authenticator/blob/master/totp/services/config/config.c#:~:text=%23define%20CONFIG_FILE_DIRECTORY_PATH,totp.conf%22)).

Detailed description of file format can be found [here](.github/conf-file_description.md)

## How to change\recover PIN?

There is no way to change or recover PIN once it is set without loosing all the token secrets. If you would like to completely reset app settings including PIN and all the tokens - just delete `/ext/apps/Misc/totp.conf` file. Flipper Authenticator will create new empty file and you will be able to setup everything from scratch.

## How to backup?

All token secrets are stored in encrypted form and are tied to an original Flipper device and PIN. Given that, there is no sense to try to backup `/ext/apps/Misc/totp.conf` file as it will not help you in situation when you loose your Flipper device. Instead use your favorite password manager to store plain token secrets and\or any other information which will help you recover your accounts.