Questions tagged [totp]

Time-based One-time Password Algorithm

Filter by
Sorted by
Tagged with
0
votes
0answers
57 views

TOTP, but share server time

Is there any major flaw in using TOTP in a way where the server sends its time to the client when the client requests to log in? The advantage of this is the client's time does not have to be set ...
0
votes
1answer
55 views

Is this a secure way of authenticating, advice on what to change?

I have a few terminals that I currently use a static IP to authenticate. The problem is in my country the internet is not stable, so often I have to switch to mobile data, then the terminals can't ...
5
votes
1answer
578 views

Does TOTP make sense for verification codes?

I know that the concept of TOTP is for when the device on which the code is to be verified is separate from the device that is going to generate the code. However, I was wondering if it is a bad idea ...
0
votes
0answers
14 views

problem in implementing google authenticator app in c++ [migrated]

i am trying to implement google Authenticator mechanism in c++. i always get different OTP than that of google authenticator. i wonder why ? 1 - i searched and found that google uses HMAC-SHA1 ...
1
vote
3answers
101 views

Why would a U2F key be more secured than an OTP device?

I have a Yubikey 5, I can store a PGP key inside, it has OTP abilities, FIDO, NFC, etc... Which is great for a device like this. First of all, I understand how a smart card is more secured than an app/...
1
vote
1answer
51 views

What are the security flaws in web based TOTP app?

If there is a widely accessible TOTP website (prototype: https://depperm.github.io/) that allows users to set a date and secret they can remember or a package that allows companies/developers to ...
2
votes
2answers
170 views

How is mailbox.org 2FA method referred to as, correctly?

Their 2FA to log in to their web interface requires two things: something you know (PIN); something you have (OTP, generated by app for example). After that, you need to log in by: input email ...
5
votes
1answer
279 views

Securely detecting and correcting time drift for TOTP

RFC 6238 recommends the server to implement some form of resynchronization algorithm to account for time drift of the device used to generate the OTP. However, the RFC provides very little information ...
1
vote
0answers
51 views

How does Authy implement multi-device mode?

This question has been asked previously, here. However, none of the answers there address the question. The accepted answer conflates Authy's multi-device mode with its cloud backup feature. I am ...
0
votes
1answer
57 views

Is 2FA required for one-time login links?

I'm currently implementing 2FA and ask our users that login with their email/pass to enter their code when 2FA is enabled. This is all good. But I also offer a "I forgot my password" access ...
1
vote
1answer
74 views

TOTP - Larger Timesteps

I'm in the process of implementing TOTP based on RFC6238. The RFC's recommend time step is 30 seconds. However, for addressing a resynchronization problem that we have, if I use a larger time step, ...
0
votes
2answers
142 views

Why make it difficult to disable MFA tokens?

Some websites make it easy to enrol multiple TOTP apps at the same time but make it difficult to disable these apps. For instance, the user would have to completely reset the MFA settings instead of ...
1
vote
3answers
177 views

prevent/prohibit duplication of MFA software-token / ensure user identity

As I was unable to find any thread about this particular question, I'm trying to ask the community for help. We're currently using RSA RADIUS based 2FA to authenticate external VPN users from ...
1
vote
2answers
117 views

In case of TOTP code generation, why do products prefer a generic authenticator apps, such as Google Authenticator?

All the products supporting TOTP-based 2FA use one of the common authenticator apps such as Google Authenticator, Authy, etc. I want to understand whether there are any security reasons behind why ...
0
votes
0answers
86 views

Combine HOTP and TOTP

I want to build a custom OTP implementation that utilizes the HOTP/TOTP algorithm. I need to create several codes (one time passwords), which are all valid for the same time window in the future (e.g....
3
votes
2answers
988 views

How do backup codes work in TOTP, like Google Authenticator?

My understanding is that in TOTPs are like HMAC where code is derived from time. However, I am struggling to understand the concept of Backup Codes in Google Authenticator, and how are they ...
1
vote
1answer
79 views

Is it unsecured to use TOTP codes on the device that generates them?

Let's say I have a TOTP generator app (like Google Authenticator) installed on my smartphone. I use it for 2FA for service X. How bad is it if I log in to X's website/dedicated app on the same ...
1
vote
1answer
213 views

How should I store TOTP recovery codes on the server end?

In TOTP implementations, it's always suggested that you give your users recovery codes. Should I treat these like tokens? Display them once and hash them? If so, I'd love to know why. If not, I'm ...
3
votes
0answers
186 views

One time password: combine time window and counter

I want to generate an OTP, that is valid once in a certain time window in the future. That time window is in the range of minutes to hours. After being used in that window, the OTP may not be used ...
5
votes
3answers
679 views

Do backup codes render 2FA useless?

I've been trying to implement 2FA for a web application, both server and client side. As everybody knows, an H/TOTP is intended to prove that I own something, for example through the use of an ...
2
votes
2answers
938 views

Is it safe to save a screenshot of my QR code?

For MFA I now use Authy (owned by Twilio) instead of Google Authenticator. I find Authy more convenient because it syncs your accounts between several devices and several authy installations which ...
0
votes
1answer
84 views

Securing shared key in TOTP Implementations

I'm currently learning about Time-based One-Time Password implementations (see RFC6283). I see that a shared secret is part of the algorithm. This shared secret is exposed to the user (see example ...
2
votes
1answer
163 views

Are there security advantages to adding an OTP to SSH connections?

Are there any tangible improvements to gain from enabling TOTP (google-authenticator PAM plugin) over existing public key based SSH connections? Does it make security sense to enable TOTP based Two-...
62
votes
2answers
9k views

How are one-time password generators like Google Authenticator different from having two passwords?

Google Authenticator uses the TOTP algorithm to generate your One-Time Password (OTP). TOTP works like this : The server generates a secret key and shares with the client (you) when the client ...
1
vote
0answers
35 views

Risks of allowing an account to register multiple TOTPs

Is there any security risk for an application allowing a user to register multiple TOTP devices for a single account? I've noticed that with many popular accounts (gmail, github) you have the ability ...
1
vote
1answer
84 views

MFA for multiple accounts?

We are thinking about enabling 2FA with Google Authenficator for all our services. But the only concern for me now is that users will have to have a dedicated Authenticator's account for every ...
3
votes
2answers
893 views

Can a Time-based One-time Password (TOTP) key be decoded from generated values?

If you have access to generated Time-based One-time Password (TOTP) values, is it theoretically possible to decode the secret key? If yes, how much time and about how many generated values are needed?...
4
votes
2answers
5k views

How do I back up YubiKey-backed TOTP authentication?

I bought a YubiKey 5 NFC this week and have started using 2FA and U2F where I can but am deathly allergic to the idea of losing access. For backing up U2F access I'm going to buy a second U2F token (...
0
votes
1answer
110 views

How does DUO push button method and other methods actually work?

Google authenticator uses HOTP and TOTP algorithm for TFA. What is the basic working principle of DUO push? What brings security to DUO push?
0
votes
2answers
680 views

Should I use TOTP when using OAuth2

I'm implementing TOTP in my application to allow users to use two factor authentication with Google authenticator and the like. However I've also implemented "social login" using OAuth, should the ...
0
votes
0answers
1k views

Two-factor authentication on Galaxy Watch - should secrets be encrypted, and is this SQLite example secure?

I recently got a Galaxy Watch and to get acquainted with developing apps for it I'm writing a simple two factor authenticator to generate TOTP codes from entered secrets using the Google Authenticator ...
0
votes
1answer
157 views

Are there security issues in not supporting TOTP 2FA for 1Password? [closed]

1Password sort of supports 2FA. We have a master password and an additional secret. But why don't they support TOTP for 2FA? I just want to make really sure that unless I approve, no other devices ...
0
votes
1answer
261 views

Risks of sharing multiple, old TOTP codes?

What are the risks (if any) of sharing the TOTP codes? I'm referring to the six-digit codes generated by Google Authenticator and the like. By "sharing old tokens" I'm thinking of posting online a ...
3
votes
1answer
340 views

Is it reasonable to store encrypted TOTP keys + authentication credentials on a single device (for end-user)?

My current security model (at least for passwords) is to store them encrypted at rest and use GPG (in combination with an Yubikey) to perform encryption / decryption. I'm using pass (https://www....
10
votes
2answers
2k views

Is it a bad idea to have the user choose the TOTP secret instead of generating it automatically?

Reading about TOTP-based authentication systems that use smartphones as one-time code generators, I seem to understand that typically the shared secret is generated automatically by the "server" (the ...
3
votes
4answers
3k views

What are dedicated TOTP devices called?

I would like to buy a device that can be provisioned with a secret seed and then displays a time based authentication token without ever revealing the seed. As terms like 2FA, TOTP and Authenticator ...
20
votes
1answer
8k views

Storing TOTP secret in database, plaintext or encrypted?

I've been reading about 2FA and how it is used, and the thing that struck me most is that everyone seems to be storing the TOTP secret as plaintext in their database. I understand you need the secret ...
1
vote
2answers
1k views

How can Authy use Google Authenticator QR

I was just reading around and found it really fascinating that Authy can use Google Authenticator implementations anywhere. How does Authy does this? Isn't this a security risk?
1
vote
0answers
287 views

How exactly do Fido Keys work? [closed]

Recently I acquired a security Fido key that allows me to use the U2F protocol on some of my accounts. Now I know that these keys use public/private keys for the specified account but I'm stuck on the ...
3
votes
2answers
644 views

Using the Symantec VIP Access smartphone software for 2FA

I'm most accustomed to using Google Authenticator / FreeOTP for my 2FA needs. This system allows me to have separate TOTP streams for each site and allows me to backup my seeds (by printing the QR ...
0
votes
2answers
5k views

Does the TOTP Algorithm rely on the client time always being synced correctly?

What happens if for some reason a cell phones clock / calendar is off by a significant amount of time? Does the TOTP (Time-based OTP) algorithm generate an invalid token? Also, do time zones play a ...
4
votes
1answer
159 views

Strong unique passwords and TOTP 2FA

So I use a password manager with to generate a (strong) unique password for each and every site I have a username / password for. For the ones that allow it I also enable TOTP (Time-based One-Time ...
1
vote
0answers
42 views

Does producing TOTP tokens weaken the stored secret? How much? [duplicate]

I am using Google Authenticator as a second factor on some sites, (including my Google Account). Every now and then I need to produce a token to log in. If some attacker received those tokens over ...
7
votes
2answers
2k views

Is accepting the current and the previous one-time password a bad practice?

I often see two-factor authentication (2FA) methods using one-time passwords (OTP) implementations wherein the current (previous) and sometimes even 2 or 3 previous tokens are still valid. This is ...
6
votes
2answers
1k views

How many known time/result combinations does it take to guess a HOTP/TOTP secret?

I thought about "recovering", "determining", "guessing", "calculating" or "reproducing" the HOTP/TOTP secrets when only the outcome (6-digit code + time) is known. In case we can view the live ...
4
votes
3answers
404 views

What security considerations should I make when choosing a TOTP app?

One company now requires that I either use Authy or Google Authenticator. Supposedly these are safer than getting a text message, but I'm still seeing people complain about how dangerous these are. ...
2
votes
2answers
2k views

Is there a way to create time based OTP with public/private key

I have a situation where I need time based OTP. But most of the examples and cases I have seen, uses same key to create and check otp. But I need something different. I want to create OTP using a ...
3
votes
1answer
162 views

How can I back up my iPhone without compromising my 2FA and master keys?

I've noticed that when I restore my old iPhone's backup to a new iPhone, 1Password's master-key (which is never supposed to leave the device 1Password is installed on, and you transfer manually), my ...
4
votes
1answer
672 views

TOTP / HOTP - Offline 1 hour password generator

I need to generate and valid a password / token for an hour. Client -> generate password (valid for one hour) Server -> valid it within an hour. //System needs to work offline (TOTP) TOTP is ...
1
vote
4answers
546 views

Implementation flow of MFA with TOTP

For a frontend, i would like to implement MFA (with TOTP). I may be searching for the wrong keywords but i couldn't find the proper way to implement securely this solution. I was searching for a ...