I am currently writing a TOTP implementation in PHP (but this applies to other languages as well) and of course want it to be as secure as possible, what should be considered?
- Every single used code is blacklisted for 2 minutes, independent of whether it was successful or not
- The secret is generated by a secure random number generator
- The QR code is generated on my machine and not handed over to third party providers
- Entering a reCaptcha is required in order to prevent brute force attacks
- Codes are validated using a timing attack resistant comparison function
- A total of 5 codes are checked (the current, the last two and the next two)
- A single 16-character rescue code is generated (by a secure random number generator) and only shown once after successful activation, it cannot be retrieved by the user afterwards
- Users are asked only once every seven days on a known machine (by setting a cookie)
- Secrets and Rescue codes are stored unencrypted in the database, but this should not be an issue as the script needs to decrypt it anyway
Am I missing some important? Are some of the points a bad decision?