I would like to add two factor authentication to a login screen. My understanding of the process is the following:
- Generate a QR Code
- Scan this Code with Google Authenticator app
- Use a library to check if the Google authenticator code matches the code the user has entered.
I would like to use PHP for the authentication. I am a little bit unsure what might be the best code for generating the QR code. As it should be unique, I thought about the hashed password from the user database. Because if the attacker has access to the server, there might be no way to protect the qr code generation. Or is there a way to protect the key?
A random string would not work because it would change each time and the user would need to scan the code each time again.
What is a proper way to create relatively secure two factor authentication and what is the common key to generate the qr code? Where should the key for the qr code be stored? And what is a recommended library for it using PHP?