Request for entire IT industry and SecSMS release

 

Request:

               Creating a standard and across platforms, ex: WhatsApp codes -> Desktop, Apple iOs, Symantec VIP -> Desktop etc…

You update your passwords — but how do you get a TOTP secret onto your phone without showing it on the screen even once? Every enrollment QR code you display can be photographed, screenshotted, or watched by whatever (or whoever) is spying on your screen. The newest SecSMS release removes that exposure completely: the TOTP secret is never displayed anywhere — not on the web page, not on Windows, not on Android.

What is new

Masked clipboard TOTP enrollment — Windows to Android over PQ-encrypted Bluetooth. When a website copies a masked TOTP enrollment (an otpauth://totp/... URI) to the clipboard instead of showing a QR code, you can now push it straight to the Android app. The clipboard content is validated, confirmed with only issuer/account names visible, encrypted, sent — and then the clipboard is cleared. A screen spy sees nothing but asterisks.

Bare Base32 secrets supported too. Some sites copy only the raw secret. Paste it the same way; the Android app asks for the issuer/account name and enrolls it with standard SHA1 / 6-digit / 30-second parameters.

TOTP list improvements. Issuer and account are shown on separate lines, unnamed entries get unique labels instead of identical blank rows, and re-scanning or re-importing the same account updates it instead of creating duplicates.

The cryptography

The transfer uses the same post-quantum hybrid channel as the existing OTP send: ML-KEM-768 (the NIST-standardized post-quantum KEM) plus ephemeral X25519, with keys combined through HKDF-SHA256 into AES-256-GCM. The Android phone generates its keypair locally, transmits only the public key bundle, and decrypts the enrollment — a Bluetooth sniffer sees nothing but ciphertext.

Every byte-level detail — framing, key derivation, associated data, message types, both protocol flows, and the honest limitations — is documented here:

https://github.com/ALightTechnologyAndServicesLimited/SecSMS/blob/main/PROTOCOL.md

How to use it

1. On Windows, open SecSMS and click Start Bluetooth.
2. On Android, open the TOTP tab and tap From Desktop, then pick your paired Windows device. (The phone sends only its public key bundle — private keys never leave it.)
3. On Windows, click Send TOTP from clipboard. Confirm the masked prompt — it shows the account name, never the secret.
4. On Android, name the account if prompted. Done — the entry appears in the list and codes can be copied or sent to Windows over the same encrypted channel.

QR scanning and manual entry remain available as before.

Also in this release

• TOTP authenticator (RFC 6238, SHA1/SHA256/SHA512, 6–8 digits), secrets in Keystore/Keychain SecureStorage, codes always masked.
• Biometric app lock (Strong/Class 3 biometrics) protecting messages and codes.
• SMS OTP masking and PQ-encrypted OTP transfer to Windows clipboard with auto-clear.

Links

• Source code: https://github.com/ALightTechnologyAndServicesLimited/SecSMS
• Protocol documentation: https://github.com/ALightTechnologyAndServicesLimited/SecSMS/blob/main/PROTOCOL.md
• Website: https://www.alightservices.com/

SecSMS exists for one reason: to make OTP and identity theft harder. The less that ever touches a screen, the less there is to steal.

 

Known Issues:

1.       If there is a hacker recording traffic, they might know the TOTP code, PQ VPN needed.

2.       If targeted by NIST, even PQ VPN can’t help.

 

Plan:

1)       Capability to implement PQ for transferring from server to SecSMS even without VPN, VPN level protection.

2)       Several languages support.

Follow on social media to stay updated on the latest developments:

ALight Technologies USA Inc | Facebook

https://www.facebook.com/ALightTechnologyAndServicesLimited

Web Veta | Facebook

WebVeta Saas | LinkedIn

https://www.linkedin.com/company/alight-technologies-usa-inc/

https://www.linkedin.com/company/alight-technology-and-services-limited/

https://twitter.com/ALightTech

https://www.youtube.com/@alighttechnologyandservicesltd

https://blog.alightservices.com/

https://medium.com/@ALlightTechnologyAndServices

-

Best regards,

Mr. Kanti Arumilli 

I don’t have any fake aliases, nor any virtual aliases like some of the the psycho spy R&AW traitors of India. NOT associated with the “ass”, “es”, “eka”, “ok”, “okay”, “is”, erra / yerra karan, kamalakar, diwakar, kareem, karan, erra / yerra sowmya, erra / yerra, zinnabathuni, bojja srinivas (was a friend and batchmate 1998 – 2002, not anymore – if he joined Mafia), mukesh golla (was a friend and classmate 1998 – 2002, if he joined Mafia), erra, erra, thota veera, uttam’s, bandhavi’s, bhattaru’s, thota’s, bojja’s, bhattaru’s or Arumilli srinivas or Arumilli uttam(may be they are part of a different Arumilli family – not my Arumilli family)