Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [totp]

Time-based One-time Password Algorithm

1
vote
1answer
54 views

MFA for multiple accounts?

We are thinking about enabling 2FA with Google Authenficator for all our services. But the only concern for me now is that users will have to have a dedicated Authenticator's account for every ...
2
votes
2answers
83 views

Can a Time-based One-time Password (TOTP) key be decoded from generated values?

If you have access to generated Time-based One-time Password (TOTP) values, is it theoretically possible to decode the secret key? If yes, how much time and about how many generated values are needed?...
1
vote
2answers
170 views

How do I back up YubiKey-backed TOTP authentication?

I bought a YubiKey 5 NFC this week and have started using 2FA and U2F where I can but am deathly allergic to the idea of losing access. For backing up U2F access I'm going to buy a second U2F token (...
0
votes
1answer
41 views

How does DUO push button method and other methods actually work?

Google authenticator uses HOTP and TOTP algorithm for TFA. What is the basic working principle of DUO push? What brings security to DUO push?
0
votes
1answer
99 views

Should I use TOTP when using OAuth2

I'm implementing TOTP in my application to allow users to use two factor authentication with Google authenticator and the like. However I've also implemented "social login" using OAuth, should the ...
0
votes
0answers
107 views

Two-factor authentication on Galaxy Watch - should secrets be encrypted, and is this SQLite example secure?

I recently got a Galaxy Watch and to get acquainted with developing apps for it I'm writing a simple two factor authenticator to generate TOTP codes from entered secrets using the Google Authenticator ...
0
votes
1answer
113 views

Are there security issues in not supporting TOTP 2FA for 1Password? [closed]

1Password sort of supports 2FA. We have a master password and an additional secret. But why don't they support TOTP for 2FA? I just want to make really sure that unless I approve, no other devices ...
0
votes
1answer
82 views

Risks of sharing multiple, old TOTP codes?

What are the risks (if any) of sharing the TOTP codes? I'm referring to the six-digit codes generated by Google Authenticator and the like. By "sharing old tokens" I'm thinking of posting online a ...
3
votes
1answer
116 views

Is it reasonable to store encrypted TOTP keys + authentication credentials on a single device (for end-user)?

My current security model (at least for passwords) is to store them encrypted at rest and use GPG (in combination with an Yubikey) to perform encryption / decryption. I'm using pass (https://www....
9
votes
2answers
2k views

Is it a bad idea to have the user choose the TOTP secret instead of generating it automatically?

Reading about TOTP-based authentication systems that use smartphones as one-time code generators, I seem to understand that typically the shared secret is generated automatically by the "server" (the ...
3
votes
4answers
2k views

What are dedicated TOTP devices called?

I would like to buy a device that can be provisioned with a secret seed and then displays a time based authentication token without ever revealing the seed. As terms like 2FA, TOTP and Authenticator ...
11
votes
1answer
2k views

Storing TOTP secret in database, plaintext or encrypted?

I've been reading about 2FA and how it is used, and the thing that struck me most is that everyone seems to be storing the TOTP secret as plaintext in their database. I understand you need the secret ...
1
vote
2answers
411 views

How can Authy use Google Authenticator QR

I was just reading around and found it really fascinating that Authy can use Google Authenticator implementations anywhere. How does Authy does this? Isn't this a security risk?
1
vote
0answers
191 views

How exactly do Fido Keys work? [closed]

Recently I acquired a security Fido key that allows me to use the U2F protocol on some of my accounts. Now I know that these keys use public/private keys for the specified account but I'm stuck on the ...
1
vote
1answer
232 views

Using the Symantec VIP Access smartphone software for 2FA

I'm most accustomed to using Google Authenticator / FreeOTP for my 2FA needs. This system allows me to have separate TOTP streams for each site and allows me to backup my seeds (by printing the QR ...
-1
votes
2answers
2k views

Does the TOTP Algorithm rely on the client time always being synced correctly?

What happens if for some reason a cell phones clock / calendar is off by a significant amount of time? Does the TOTP (Time-based OTP) algorithm generate an invalid token? Also, do time zones play a ...
3
votes
1answer
134 views

Strong unique passwords and TOTP 2FA

So I use a password manager with to generate a (strong) unique password for each and every site I have a username / password for. For the ones that allow it I also enable TOTP (Time-based One-Time ...
1
vote
0answers
32 views

Does producing TOTP tokens weaken the stored secret? How much? [duplicate]

I am using Google Authenticator as a second factor on some sites, (including my Google Account). Every now and then I need to produce a token to log in. If some attacker received those tokens over ...
7
votes
2answers
1k views

Is accepting the current and the previous one-time password a bad practice?

I often see two-factor authentication (2FA) methods using one-time passwords (OTP) implementations wherein the current (previous) and sometimes even 2 or 3 previous tokens are still valid. This is ...
5
votes
1answer
563 views

How many known time/result combinations does it take to guess a HOTP/TOTP secret?

I thought about "recovering", "determining", "guessing", "calculating" or "reproducing" the HOTP/TOTP secrets when only the outcome (6-digit code + time) is known. In case we can view the live ...
3
votes
3answers
323 views

What security considerations should I make when choosing a TOTP app?

One company now requires that I either use Authy or Google Authenticator. Supposedly these are safer than getting a text message, but I'm still seeing people complain about how dangerous these are. ...
1
vote
2answers
1k views

Is there a way to create time based OTP with public/private key

I have a situation where I need time based OTP. But most of the examples and cases I have seen, uses same key to create and check otp. But I need something different. I want to create OTP using a ...
3
votes
1answer
122 views

How can I back up my iPhone without compromising my 2FA and master keys?

I've noticed that when I restore my old iPhone's backup to a new iPhone, 1Password's master-key (which is never supposed to leave the device 1Password is installed on, and you transfer manually), my ...
3
votes
1answer
418 views

TOTP / HOTP - Offline 1 hour password generator

I need to generate and valid a password / token for an hour. Client -> generate password (valid for one hour) Server -> valid it within an hour. //System needs to work offline (TOTP) TOTP is ...
1
vote
4answers
355 views

Implementation flow of MFA with TOTP

For a frontend, i would like to implement MFA (with TOTP). I may be searching for the wrong keywords but i couldn't find the proper way to implement securely this solution. I was searching for a ...
4
votes
2answers
346 views

Best practices for handling wrong TOTP tokens

Assume a 2FA system with user-supplied passwords and 6 digit TOTP tokens. It is not possible to test a TOTP token without authenticating with a password first, so whoever submits a token is presumed ...
0
votes
1answer
58 views

Security Concerns in an Inventory TOTP Scheme using Time-Variant Keys

Assume we chose to change the secret key in HMAC generation for TOTP, every second. How can we authenticate to such a scheme assuming a 32 byte key is randomly generated passing posix time to srand() ...
1
vote
2answers
646 views

How secure are TOTP codes?

I was wondering about the security of TOTP codes. Is there any cryptographic security around the secret to stop a user being able to guess the secret after capturing a variety of TOTP codes. For ...
1
vote
2answers
121 views

Why do I see 2FA but not see “two separate entities” being prioritized in website authentication?

I've seen a number of 2 step website authentication methods out there. Some include two passwords, HOTP/TOTP, Yubikey, SMS to a phone number, etc. However, it seems like all of these systems rely on ...
2
votes
3answers
408 views

Is using the 2FA secret on the same machine as using the credentials, removing one factor of 2FA?

In other words: Is saving or using the two-factor authentication (2FA) secret on the same machine to generate one-time passwords (OTP), breaking the two-factor authentication (2FA) concept since it's ...
1
vote
1answer
150 views

Can an attacker extrapolate future codes based on past codes and their timestamps from a TOTP device?

I recently started using a TOTP fob to secure some of my cloud hosting accounts, and I'd likely to familiarize myself with possible attack vectors I should watch out for while I use this system (my ...
1
vote
1answer
610 views

TOTP: Storing symmetrical secrets

I'm in the process of researching 2fa methods for a cloud connected physical access control system. There is very little margin for error in this space. Is it just me or does TOTP for two factor auth ...
5
votes
1answer
1k views

Two factor brute force protection

If I implement two factor authentication using TOTP, I (obviously) have to protect against simple brute force attacks of the TOTP value. If I ask for the TOTP value after successful password login, ...
3
votes
2answers
122 views

IP Restricted OTP like Web Admin Authentication Safe or Not

I created a web admin panel with the following security implementation. It is located on a sub directory of the web, which will trigger a 404 Error when tried to access (just like the link is broken ...
4
votes
1answer
834 views

In a TOTP implementation, does there need to be an expiration policy for the user's secret key?

Background We're starting a project to add an additional authentication factor to our web application. This involves the creation of a TOTP (Time-Based One-Time Password) token that conforms to RFC ...
2
votes
1answer
275 views

What is the benefit of using lastpass authenticator on android compared to other similar applications?

Lastpass recently (march 2016) released a new app called lastpass authenticator. Reading their blog post and the description of the app features, it looks like to me that the app does nothing more ...
5
votes
1answer
2k views

How to get TOTP password with hmac sha 512 as hashing function?

ive never learned about javascript and network security before, but lately ive taken on some programming challange but i have to send my project link via http post request, and i have to figure the ...
2
votes
0answers
68 views

Setting date/time to future on soft time-based one time password (TOTP) algorithms?

I am evaluating a two-factor authentication system that uses a time-based one-time password algorithm. This runs as an Android application. As you would expect, this seems to be using a seed and the ...
12
votes
2answers
1k views

What happens if a (google authenticator) one time password QR code is leaked?

When there are QR codes for one time password (OTPs) urls (starting with otpauth://) that are supposed to be looked up in an authenticator app such as Google authenticator, what happens if a user ...
3
votes
1answer
960 views

Can two TOTP clients register at the same time and generate the same tokens?

Note that I'm not talking about systems like Authy, where you can log in to your account on multiple devices and sync your tokens between them -- I'm referring to two completely separate devices that ...