Is TOTP Authenticator safe?
TOTP Authenticator reads Firebase account data and decrypts it with a key derived only from the user's email address.
The extension subscribes to Firebase database paths for the signed-in user's TOTP account records and decrypts the returned data in the popup. It derives the decryption key from the SHA-256 hash of the user's email address, and the background worker uses the same method before showing desktop notifications.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
Who publishes itbinaryboot - no other listings under this identity
binaryboot - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
What it can do
Permissions this extension asks for, as declared in version 3.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on binaryboot.com
https://*.binaryboot.com/*
Read and change your data on totpauthenticator.firebaseapp.com
https://totpauthenticator.firebaseapp.com/*
Read and change your data on firebaseio.com
https://*.firebaseio.com/*
Read and change your data on apis.google.com
https://apis.google.com/*
Store data in your browser
storage
Sign you in with your Google account
identity
Show you desktop notifications
notifications
Act on the current tab, but only after you click the extension
activeTab
Where it sends data
Destinations our analysis observed TOTP Authenticator contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- totpauthenticator.firebaseio.com
TOTP Authenticator sends data to totpauthenticator.firebaseio.com. No other extension we have analysed sends data here.