PHP - Google Authenticator URI codes don't always work - php

Question

So i'm having a problem with google authenticator and my PHP.
So i'm using this library to generate QR codes: https://github.com/PHPGangsta/GoogleAuthenticator
So when I use my username to generate a code it works fine. I get something along the lines of:
otpauth://totp/username?secret=aCodeInBase32&issuer=Mysite
For my case it is:
otpauth://totp/NoahNok?secret=aCodeInBase32&issuer=Mysite
however when doing this for any other use I get an invalid token error on the Google Authenticator app. It doesnt matter what else I put I always seem to get this error, yet it works fine for my account.
E.g this one doesn't work: otpauth://totp/Test?secret=KRSX&issuer=MySite
Is there something obvious im doing wrong?
Code im using:
Some queries before to get data
$g = new PHPGangsta_GoogleAuthenticator();
include("Base32.php");
$secret = substr(Base32::encode($username),0,-4);
echo $g->getQRCodeGoogleUrl($username, $secret, "MySite");
Generates QR URL
public function getQRCodeGoogleUrl($name, $secret, $title = null, $params = array())
{
$width = !empty($params['width']) && (int) $params['width'] > 0 ? (int) $params['width'] : 200;
$height = !empty($params['height']) && (int) $params['height'] > 0 ? (int) $params['height'] : 200;
$level = !empty($params['level']) && array_search($params['level'], array('L', 'M', 'Q', 'H')) !== false ? $params['level'] : 'M';
$urlencoded = urlencode('otpauth://totp/'.$name.'?secret='.$secret.'');
if (isset($title)) {
$urlencoded .= urlencode('&issuer='.urlencode($title));
}
return 'https://chart.googleapis.com/chart?chs='.$width.'x'.$height.'&chld='.$level.'|0&cht=qr&chl='.$urlencoded.'';
}

Answer 1

Base32 is padded out to the nearest multiple of 8 characters, so it won't always have ==== at the end to strip off. From your examples we get:
NoahNok => JZXWC2CON5VQ====
and:
Test => KRSXG5A=
So if you remove the last 4 characters always you'll create an invalid Base32 sequence for situations like the latter. You could instead use rtrim like so:
$secret = rtrim(Base32::encode($username), '=')
to just remove all trailing equals (or just leave them in).
Edit
I was just thinking about this and while the above will fix the proximate issue, generating the secret this way is probably not a good idea. If you think about it, setting the secret equal to the username means that if someone finds the username they can generate a valid OTP and therefore be able to pass their 2FA.
Secret should be unique and generally unguessable for this purpose, and the library you are using has a createSecret method to do this for you.