I have implemented the login/verification aspect of a two factor auth system as per RFC 6238.
It works fine with Google Authenticator, which is great.
Now I am turning my attention to the backup codes, that are provided by services implementing 2FA such as Google and GitHub.
I notice they are of a different length and/or format to the usual 6 digit direct authentication code.
So, do I:
- Generate an arbitrary number of codes when a user sets up 2FA
- Store them in the DB alongside the user
- Make use of the fact they are a different length or format in order to decide how to check them?
Are they supposed to be random, or generated based on some hash of the user?