TOTP: Switch to an internal QR Code provider.

[georgestephanis]

Currently we're using a Google API to generate the QR codes. Let's switch to an internal provider instead, either PHP or JS -- either from the https://github.com/kazuhikoarase/qrcode-generator repository should do just as well. It seems to be the standard (many other libraries already use it), and is MIT licensed. 👍

[voldemortensen]

I vote we do PHP as we need a no-js fallback.

[shield-9]

http://phpqrcode.sourceforge.net/ (licensed under LGPL) can generate QR Code in SVG and PNG.
If we use SVG, it won't become dim by zooming in. (And less memory & network usage)

[TimothyBJacobs]

FYI: https://groups.google.com/forum/#!topic/google-chart-api/rZtHTyYgyXI

Google's Charts QR API is shutting down permanently on March 14.

[cuberoot74088]

Dear all,

First of all, thanks for creating and maintaining this plugin.

I have just realized, that the TOTP QR code is generated via an google charts api call and was a bit surprised, since it sends over the secret (second factor) to a third party. So it might not be secret any more.

I have also seen the PR #388 to create it internally, but seems it has not made it. Maybe it is not the super duper perfect solution, but probably better than a public api call?

What are your thoughts on that?

Is there some rough idea when and how to fix this and generate it internally?
What could help to get it done?
Maybe searching for some libs again, since some time has passed already ...

Best regards
Cuberoot