https://hostspica.com/research Engineering write-ups, R&D notes and guides on how HostSpica apps are built and secured. en https://hostspica.com/research/sms-vs-totp-vs-passkey-which-second-factor-to-use https://hostspica.com/research/sms-vs-totp-vs-passkey-which-second-factor-to-use A plain comparison of SMS codes, TOTP authenticator apps and passkeys: what each one stops, what it does not, and a simple order of preference with recovery in mind. Sun, 04 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/move-from-google-authenticator-to-hostspica-step-by-step https://hostspica.com/research/move-from-google-authenticator-to-hostspica-step-by-step Export your accounts from Google Authenticator and scan them into HostSpica Authenticator, including large exports, checks to run before you delete anything, and what to do if a code does not match. Sun, 04 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/what-to-do-if-you-lose-your-phone-recovery-guide https://hostspica.com/research/what-to-do-if-you-lose-your-phone-recovery-guide A recovery plan for a lost or reset phone: what to prepare in advance, what to do in the first hour, how to restore a HostSpica backup, and why passkeys cannot be restored. Sun, 04 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/how-to-set-up-a-passkey-on-android-with-hostspica-identity https://hostspica.com/research/how-to-set-up-a-passkey-on-android-with-hostspica-identity Turn on HostSpica Identity as a passkey provider on Android 14 or newer, create and use a passkey on a test site, sign in on a computer, and remove a passkey you no longer want. Sun, 04 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/ctap-2-3-draft-notes-what-applies-to-a-phone-passkey-provider https://hostspica.com/research/ctap-2-3-draft-notes-what-applies-to-a-phone-passkey-provider Our reading of the FIDO CTAP 2.3 review draft: what CTAP is for, which parts matter to an Android passkey provider, what we follow instead, and why we make no CTAP conformance claim. Sun, 04 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/why-we-dropped-our-custom-bluetooth-passkey-protocol https://hostspica.com/research/why-we-dropped-our-custom-bluetooth-passkey-protocol We built our own Bluetooth pairing protocol for signing in on a computer with a phone passkey, then removed it. What it was, why it could not work for most sites, and what Android does instead. Sun, 04 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/rnd-the-bluetooth-gatt-service-cache-bug-that-broke-every-second-session https://hostspica.com/research/rnd-the-bluetooth-gatt-service-cache-bug-that-broke-every-second-session A real bug from building a phone-to-browser Bluetooth link: a fresh service UUID per session meant the second session never connected, because the browser's platform cached the first one. Symptoms, cause and the fix. Sun, 04 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/how-hostspica-identity-links-a-2fa-code-a-passkey-and-a-password-to-one-service https://hostspica.com/research/how-hostspica-identity-links-a-2fa-code-a-passkey-and-a-password-to-one-service How the Identity tab decides that GitHub the issuer, github.com the passkey and a saved github.com password are one account, the heuristic behind it, its limits, and the stricter rule Autofill uses. Sun, 04 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/clipboard-and-screenshot-protections-what-they-actually-stop https://hostspica.com/research/clipboard-and-screenshot-protections-what-they-actually-stop What HostSpica does to keep secrets off screenshots and the clipboard, what each measure really stops on Android, and one place where our 30-second clipboard clear is weaker than we first described. Sun, 04 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/hostspica-identity-dependency-and-permission-inventory-1-0-0 https://hostspica.com/research/hostspica-identity-dependency-and-permission-inventory-1-0-0 Every library and permission in HostSpica Identity 1.0.0: versions, what each is for, what is absent (no analytics, ads or Firebase), and how to check the permission list yourself. Sun, 04 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/hostspica-security-design-report-v1 https://hostspica.com/research/hostspica-security-design-report-v1 One document covering what HostSpica Authenticator, Passkey and Identity protect, how, what was tested, what is known to be weak, and what has changed. Our own report, not an audit. PDF available. Sun, 04 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/google-authenticator-what-it-is-how-it-works-and-alternatives https://hostspica.com/research/google-authenticator-what-it-is-how-it-works-and-alternatives What Google Authenticator is, how its six-digit codes work, how to sync or transfer them to a new phone, its limits, and how it compares with other authenticator apps. Sun, 04 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/authenticator-login-how-to-sign-in-with-an-authenticator-app https://hostspica.com/research/authenticator-login-how-to-sign-in-with-an-authenticator-app How an authenticator login works step by step, how to set it up, what to do when the code is rejected, and how to sign in if you lost your phone. Sun, 04 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/microsoft-authenticator-what-it-does-and-how-it-compares https://hostspica.com/research/microsoft-authenticator-what-it-does-and-how-it-compares What Microsoft Authenticator does: push approval, passwordless sign-in, passkeys and verification codes, how it differs from Google Authenticator and HostSpica Identity, and its trade-offs. Sun, 04 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/authenticator-app-what-it-is-and-how-to-choose-one https://hostspica.com/research/authenticator-app-what-it-is-and-how-to-choose-one What an authenticator app is, how it keeps your accounts safer, the types of authenticator apps, and a checklist for choosing one: backup, recovery, privacy, offline use and lock. Sun, 04 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/google-authenticator-on-pc-how-to-get-codes-on-a-computer https://hostspica.com/research/google-authenticator-on-pc-how-to-get-codes-on-a-computer Is there a Google Authenticator for Windows or Mac? What Google offers, safer and riskier ways to get codes on a computer, and how to avoid fake downloads. Sun, 04 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/authenticator-browser-extension-is-it-safe-and-should-you-use-one https://hostspica.com/research/authenticator-browser-extension-is-it-safe-and-should-you-use-one What an authenticator browser extension is, the real risks of keeping 2FA secrets in a browser, how to judge an extension, and safer options for codes on a computer. Sun, 04 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/authenticator-meaning-what-an-authenticator-is https://hostspica.com/research/authenticator-meaning-what-an-authenticator-is The meaning of authenticator: a thing that proves who you are. The three kinds of factor, what an authenticator app, a security key and a passkey provider each are, and where the word differs. Sun, 04 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/authenticator-app-download-how-to-get-one-safely https://hostspica.com/research/authenticator-app-download-how-to-get-one-safely Where to download an authenticator app safely, how to tell the real Google, Microsoft and HostSpica apps from fakes, package names to check, and what to look at before you scan your first code. Sun, 04 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/amazon-passkey-how-to-set-up-and-sign-in-with-a-passkey https://hostspica.com/research/amazon-passkey-how-to-set-up-and-sign-in-with-a-passkey How an Amazon passkey works, where to set it up in Login and security, what it replaces, and what to do if you lose the phone that holds it. Sun, 04 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/passkey-download-is-there-a-passkey-app-and-how-to-get-one https://hostspica.com/research/passkey-download-is-there-a-passkey-app-and-how-to-get-one A passkey is not an app you download. What people mean by passkey download, which apps and built-in tools can hold passkeys, and how to avoid fake apps. Sun, 04 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/google-passkey-what-it-is-and-where-it-can-be-stored https://hostspica.com/research/google-passkey-what-it-is-and-where-it-can-be-stored How passkeys work with a Google Account, where they can be saved, and how a local passkey provider such as HostSpica Identity differs from Google Password Manager. Sun, 04 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/passkey-login-how-signing-in-with-a-passkey-works https://hostspica.com/research/passkey-login-how-signing-in-with-a-passkey-works What happens when you sign in with a passkey: the challenge, your biometric, why a fake site fails, what to do if the passkey is not offered, and how to sign in on a computer. Sun, 04 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/apple-passkey-icloud-keychain-and-using-passkeys-across-android https://hostspica.com/research/apple-passkey-icloud-keychain-and-using-passkeys-across-android How Apple passkeys work with iCloud Keychain, what you cannot move to Android, how to sign in to a site on a PC or Android phone with an iPhone passkey, and the alternatives. Sun, 04 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/passkey-scanner-how-the-qr-code-sign-in-works https://hostspica.com/research/passkey-scanner-how-the-qr-code-sign-in-works What the QR code on a computer sign-in page is, who does the scanning, why a passkey app does not need its own scanner, and what to do when scanning does nothing. Sun, 04 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/my-account-passkey-where-to-find-and-manage-your-passkeys https://hostspica.com/research/my-account-passkey-where-to-find-and-manage-your-passkeys Where passkeys are listed for Google, Amazon and on your phone, how to remove or replace one, and how HostSpica Identity shows and deletes its own passkeys. Sun, 04 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/create-a-passkey-for-your-google-account-with-hostspica-identity https://hostspica.com/research/create-a-passkey-for-your-google-account-with-hostspica-identity Step by step: turn on HostSpica Identity as a passkey provider on Android 14 or newer, create a passkey for your Google Account, test it and keep your account recoverable. Sun, 04 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/check-android-app-has-no-internet-permission https://hostspica.com/research/check-android-app-has-no-internet-permission An Android app needs the INTERNET permission to reach the network. Here is how to confirm an app does not declare it, what that does and does not guarantee, and what we found in HostSpica Identity 1.0.0. Sat, 03 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/how-totp-works-and-how-hostspica-authenticator-implements-it https://hostspica.com/research/how-totp-works-and-how-hostspica-authenticator-implements-it A step-by-step walk through RFC 6238 time-based one-time passwords, the exact algorithm HostSpica Authenticator runs on your phone, the test vectors you can check it against, and where TOTP stops protecting you. Sat, 03 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/inside-google-authenticator-export-qr-otpauth-migration https://hostspica.com/research/inside-google-authenticator-export-qr-otpauth-migration What is inside the otpauth-migration QR code that Google Authenticator shows when you export accounts, how HostSpica Authenticator reads and writes it, and why exports are split into pages of at most 10 accounts. Sat, 03 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/how-hostspica-backups-are-encrypted-formats-and-limits https://hostspica.com/research/how-hostspica-backups-are-encrypted-formats-and-limits The exact format of HostSpica backup files, how your password becomes an encryption key (PBKDF2 with 600,000 rounds, then AES-256-GCM), what happens on a wrong password or a tampered file, and the limits you should plan around. Sat, 03 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/where-every-hostspica-secret-lives-keystore-key-hierarchy https://hostspica.com/research/where-every-hostspica-secret-lives-keystore-key-hierarchy Every key HostSpica Authenticator, Passkey and Identity use, where it is stored, what it protects, what is not encrypted, and what Keystore protection does and does not stop. Sat, 03 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/passkeys-from-first-principles https://hostspica.com/research/passkeys-from-first-principles A plain explanation of how passkeys and WebAuthn work: the key pair, the challenge, why a fake site cannot use your passkey, the difference between synced and device-bound passkeys, and what you lose if you lose the phone. Sat, 03 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/how-an-android-passkey-provider-works-credential-manager https://hostspica.com/research/how-an-android-passkey-provider-works-credential-manager What happens inside HostSpica Passkey when a site asks to create or use a passkey on Android: the Credential Manager hand-offs, the authenticator data we build, Android key attestation, the bugs we hit, and what we do not support yet. Sat, 03 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/how-android-autofill-and-hostspica-vault-protect-each-fill https://hostspica.com/research/how-android-autofill-and-hostspica-vault-protect-each-fill How an Android Autofill service sees a login form, how HostSpica Vault matches entries to sites, why the password is released only after a biometric check, and the limits of Autofill, including a lookalike-domain flaw we found and fixed before release. Sat, 03 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/threat-model-local-only-authenticator-passkeys-and-vault https://hostspica.com/research/threat-model-local-only-authenticator-passkeys-and-vault A plain threat model for HostSpica Authenticator, Passkey and Identity: who might attack, what each protection stops, what it does not, and which risks remain. Written by us, not independently audited. Sat, 03 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/webauthn-correctness-checklist-for-passkey-providers https://hostspica.com/research/webauthn-correctness-checklist-for-passkey-providers What a WebAuthn authenticator or passkey provider has to get right at registration and sign-in, item by item, with an honest status for HostSpica Passkey and a test plan you can run on any provider. Sat, 03 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar)