Skip to main content
OverflowAI is here! AI power for your Stack Overflow for Teams knowledge community. Learn more

Questions tagged [totp]

Time-based One-time Password Algorithm

Filter by
Sorted by
Tagged with
0 votes
0 answers
24 views

If I'm rolling out MFA to users, should I provide TOTP, SMS or both? [duplicate]

My site's users currently do not have any MFA options, but we're planning to release this feature in the near future. We've already built support for TOTP and have it working internally, but some on ...
Ben Johnson's user avatar
0 votes
0 answers
88 views

Can Sending All Possible Otp Codes Within 1 Second Bypass Server Protections? [duplicate]

I'm exploring the security implications of OTP (One-Time Password) authentication and wondering about the effectiveness of server-side protections against brute force attacks. If an attacker attempts ...
Favour's user avatar
  • 1
9 votes
1 answer
3k views

Can displaying date and time on screen upon TOTP login failure makes system more vulnerable?

We are using TOTP(https://datatracker.ietf.org/doc/html/rfc6238) for a web application to enhance the security. TOTP works on UTC. if system clock drifts OR NTP is not synced, TOTP generated by ...
tushars's user avatar
  • 91
1 vote
1 answer
118 views

Is 3DS compatible with secure 2FA technologies? (TOTP, WebAuthn)

Is PSD2's Strong Customer Authentication requirement possible to satisfy with secure 2FA solutions, such as TOTP and WebAuthn? For the purposes of this question, I'm classifying all systems where an ...
Michael Altfield's user avatar
0 votes
3 answers
172 views

Is using TOTP from Authenticator app on a mobile device instead of passwords inherently 2FA?

A related discussion can be found, specifically addressing the security implications of using only TOTP for single-factor authentication However, in my view, using a TOTP code from a Google ...
Luka Demetrashvili's user avatar
2 votes
1 answer
313 views

Is TOTP "more secure" and harder to crack than HOTP and why?

In addition to my question: How many known time/result combinations does it take to guess a HOTP/TOTP secret?. I've read often that TOTP is more secure than HOTP. One example: TOTP provides higher ...
Bob Ortiz's user avatar
  • 6,665
0 votes
0 answers
29 views

Retrieve TOTP seed from tokens and timestamps [duplicate]

I recently switched to or added the option to use time-based one time passwords, TOTP, as the second factor for some services I use. It got me wondering if it's possible to retrieve the secret seed if ...
FalcoGer's user avatar
  • 392
0 votes
2 answers
243 views

Security of password managers vs. risk of losing access

Is it safe not to have a 2FA for a password manager itself? It seems that using an app for TOTP authentication for a password manager could increase the security. But it turns out that in this case I ...
Broadways2's user avatar
1 vote
1 answer
113 views

Code logic for "don't require OTP for this device"?

I've just implemented QR-based TOTP on a web site. Immediately I have people (quite reasonably, given the application) asking for a checkbox so the site doesn't require TOTP for that computer and ...
Stephen R's user avatar
  • 111
9 votes
2 answers
3k views

Security of 2FA codes in-transit

I work on a service that handles user authentication & authorization. I recently added 2FA support (email, sms, TOTP) and while it works great, I was wondering about the security of the one-time ...
Grzegorz Judas's user avatar
1 vote
2 answers
1k views

allow same code twice google authenticator

Imagine if a user inputs a valid google auth code to LOGIN. We perform the login action. Now the user navigates to the fund transfer page and code is still valid (still within the 60 seconds or so of ...
msetam's user avatar
  • 11
1 vote
0 answers
132 views

Use TOTP as client_secret with OAuth

Can we use 10 digital TOTP as client_secret? What security problems would this do, and maybe some benefits? After all, TOTP changes every 30 seconds, but you need to know e.g. a 32 byte secret (which ...
Szyszka947's user avatar
1 vote
0 answers
120 views

Hardware TOTP system-on-chip with strongly guarded seed

I am looking for hardware TOTP system-on-chip, where it would not be possible for an adversary to extract the shared secret (TOTP seed in other words). I am researching an application, where one same ...
wick's user avatar
  • 111
4 votes
1 answer
553 views

Does sending TOTP code along with username and password defeat the purpose of 2FA?

Related: Implementation flow of MFA with TOTP I'm trying to implement 2FA with TOTP in my web application. The implementation I've looked at (the ASP.NET Core implementation of 2FA) does something ...
Acerbic's user avatar
  • 43
2 votes
2 answers
260 views

TOTP code with unicode character?

I was signing up for an app for a credit card I have and I encountered an SMS 2FA format I had never seen before. The code was 47𝞍⅗ Two digits, capital Phi, then the fraction three-fifths. To input, ...
Ken Y-N's user avatar
  • 121
0 votes
0 answers
14 views

Is a TOTP with RFC 6238 and a password in a manager 2FA? [duplicate]

For example Microsoft Outlook web based email service can be configured to require both a username/password combination and a time-based one-time password (TOTP) generated by the algorithm described ...
User65535's user avatar
  • 151
0 votes
0 answers
327 views

Why we need complicate truncation for the OTP?

If we assume that Time based OTP generates the OTP using the hash function like SHA-3. Then, the generated OTP would Hash(Secret, Shared time). We want a shortened string rather than a full hash ...
Curious_man's user avatar
-1 votes
2 answers
752 views

Is Time-based one-time password (TOTP) sufficiently secure as another factor of authentication?

Given the increasing widespread adoption of Time-based one-time password (TOTP) in view of SMS OTP hacks, Is Time-based one-time password (TOTP) sufficiently secure as another factor of authentication,...
Nathan Aw's user avatar
1 vote
1 answer
424 views

How is totp considered 2fa?

I was wondering about the design of totp and 2fa. I learned that 2fa is any 2 of the following authentication methods: Something you know (e.g. a password) Something you have (e.g. an email address) ...
Bart's user avatar
  • 51
0 votes
1 answer
697 views

Storing OTP seeds in password manager [duplicate]

I am storing my passwords in a password manager (keepass). Also I am using keepass to set up one-time passwords for some accounts. Keepass is storing the seeds of the OTP's in its database. If my ...
Michael S's user avatar
  • 101
0 votes
0 answers
217 views

Historical examples of breached TOTP secrets?

While reading about password breaches, it occurred to me; where are the TOTP shared secret breaches? Because TOTP relies on a shared secret (unlike say U2F) the server has a copy of the shared secret, ...
user8187's user avatar
  • 141
6 votes
3 answers
2k views

Using Public Key Cryptography for improving 2FA?

When using 2-factor-authentication using plain TOTP, the secret is stored on both the client and the server. This in turn means, that anyone with access to the database (and a key for it) knows the ...
Gamer2015's user avatar
  • 727
0 votes
0 answers
203 views

TOTP, but share server time

Is there any major flaw in using TOTP in a way where the server sends its time to the client when the client requests to log in? The advantage of this is the client's time does not have to be set ...
run_the_race's user avatar
0 votes
1 answer
134 views

Is this a secure way of authenticating, advice on what to change?

I have a few terminals that I currently use a static IP to authenticate. The problem is in my country the internet is not stable, so often I have to switch to mobile data, then the terminals can't ...
run_the_race's user avatar
6 votes
1 answer
1k views

Does TOTP make sense for verification codes?

I know that the concept of TOTP is for when the device on which the code is to be verified is separate from the device that is going to generate the code. However, I was wondering if it is a bad idea ...
yukashima huksay's user avatar
2 votes
3 answers
3k views

Why would a U2F key be more secured than an OTP device?

I have a Yubikey 5, I can store a PGP key inside, it has OTP abilities, FIDO, NFC, etc... Which is great for a device like this. First of all, I understand how a smart card is more secured than an app/...
Max13's user avatar
  • 195
1 vote
1 answer
300 views

What are the security flaws in web based TOTP app?

If there is a widely accessible TOTP website (prototype: https://depperm.github.io/) that allows users to set a date and secret they can remember or a package that allows companies/developers to ...
depperm's user avatar
  • 117
2 votes
2 answers
790 views

How is mailbox.org 2FA method referred to as, correctly?

Their 2FA to log in to their web interface requires two things: something you know (PIN); something you have (OTP, generated by app for example). After that, you need to log in by: input email ...
popsicleviscous's user avatar
6 votes
1 answer
2k views

Securely detecting and correcting time drift for TOTP

RFC 6238 recommends the server to implement some form of resynchronization algorithm to account for time drift of the device used to generate the OTP. However, the RFC provides very little information ...
Emond Papegaaij's user avatar
1 vote
0 answers
150 views

How does Authy implement multi-device mode?

This question has been asked previously, here. However, none of the answers there address the question. The accepted answer conflates Authy's multi-device mode with its cloud backup feature. I am ...
Tom Hunt's user avatar
  • 283
0 votes
1 answer
166 views

Is 2FA required for one-time login links?

I'm currently implementing 2FA and ask our users that login with their email/pass to enter their code when 2FA is enabled. This is all good. But I also offer a "I forgot my password" access ...
Cyril N.'s user avatar
  • 2,679
1 vote
1 answer
219 views

TOTP - Larger Timesteps

I'm in the process of implementing TOTP based on RFC6238. The RFC's recommend time step is 30 seconds. However, for addressing a resynchronization problem that we have, if I use a larger time step, ...
Sency's user avatar
  • 111
3 votes
2 answers
305 views

Why make it difficult to disable MFA tokens?

Some websites make it easy to enrol multiple TOTP apps at the same time but make it difficult to disable these apps. For instance, the user would have to completely reset the MFA settings instead of ...
Alex's user avatar
  • 31
1 vote
3 answers
468 views

prevent/prohibit duplication of MFA software-token / ensure user identity

As I was unable to find any thread about this particular question, I'm trying to ask the community for help. We're currently using RSA RADIUS based 2FA to authenticate external VPN users from ...
1_am_r00t's user avatar
1 vote
2 answers
357 views

In case of TOTP code generation, why do products prefer a generic authenticator apps, such as Google Authenticator?

All the products supporting TOTP-based 2FA use one of the common authenticator apps such as Google Authenticator, Authy, etc. I want to understand whether there are any security reasons behind why ...
supertramp's user avatar
0 votes
0 answers
335 views

Combine HOTP and TOTP

I want to build a custom OTP implementation that utilizes the HOTP/TOTP algorithm. I need to create several codes (one time passwords), which are all valid for the same time window in the future (e.g....
earthling's user avatar
  • 151
8 votes
1 answer
301 views

Is there a standard for OTPs tied to transaction details (that has been implemented in apps/devices)?

There are standards for Time-based (TOTP) and Counter-based (HOTP) One Time Password schemes. Generated OTPs are independent of the transactions they are used for, such as authorizing a login or a ...
Lukas's user avatar
  • 238
3 votes
2 answers
3k views

How do backup codes work in TOTP, like Google Authenticator?

My understanding is that in TOTPs are like HMAC where code is derived from time. However, I am struggling to understand the concept of Backup Codes in Google Authenticator, and how are they ...
blackbox007's user avatar
1 vote
1 answer
299 views

Is it unsecure to use TOTP codes on the device that generates them?

Let's say I have a TOTP generator app (like Google Authenticator) installed on my smartphone. I use it for 2FA for service X. How bad is it if I log in to X's website/dedicated app on the same ...
gronostaj's user avatar
  • 1,300
1 vote
1 answer
827 views

How should I store TOTP recovery codes on the server end?

In TOTP implementations, it's always suggested that you give your users recovery codes. Should I treat these like tokens? Display them once and hash them? If so, I'd love to know why. If not, I'm ...
Violet McKinney's user avatar
3 votes
0 answers
562 views

One time password: combine time window and counter

I want to generate an OTP, that is valid once in a certain time window in the future. That time window is in the range of minutes to hours. After being used in that window, the OTP may not be used ...
earthling's user avatar
  • 151
9 votes
3 answers
2k views

Do backup codes render 2FA useless?

I've been trying to implement 2FA for a web application, both server and client side. As everybody knows, an H/TOTP is intended to prove that I own something, for example through the use of an ...
scola's user avatar
  • 91
2 votes
2 answers
3k views

Is it safe to save a screenshot of my QR code?

For MFA I now use Authy (owned by Twilio) instead of Google Authenticator. I find Authy more convenient because it syncs your accounts between several devices and several authy installations which ...
Niklas Rosencrantz's user avatar
0 votes
1 answer
375 views

Securing shared key in TOTP Implementations

I'm currently learning about Time-based One-Time Password implementations (see RFC6283). I see that a shared secret is part of the algorithm. This shared secret is exposed to the user (see example ...
Gigi's user avatar
  • 1,320
2 votes
1 answer
362 views

Are there security advantages to adding an OTP to SSH connections?

Are there any tangible improvements to gain from enabling TOTP (google-authenticator PAM plugin) over existing public key based SSH connections? Does it make security sense to enable TOTP based Two-...
eternaltyro's user avatar
63 votes
2 answers
10k views

How are one-time password generators like Google Authenticator different from having two passwords?

Google Authenticator uses the TOTP algorithm to generate your One-Time Password (OTP). TOTP works like this : The server generates a secret key and shares with the client (you) when the client ...
Ashwin's user avatar
  • 1,657
1 vote
0 answers
138 views

Risks of allowing an account to register multiple TOTPs

Is there any security risk for an application allowing a user to register multiple TOTP devices for a single account? I've noticed that with many popular accounts (gmail, github) you have the ability ...
Jeff Wong's user avatar
1 vote
1 answer
180 views

MFA for multiple accounts?

We are thinking about enabling 2FA with Google Authenficator for all our services. But the only concern for me now is that users will have to have a dedicated Authenticator's account for every ...
setevoy's user avatar
  • 111
4 votes
2 answers
4k views

Can a Time-based One-time Password (TOTP) key be decoded from generated values?

If you have access to generated Time-based One-time Password (TOTP) values, is it theoretically possible to decode the secret key? If yes, how much time and about how many generated values are needed?...
Majal's user avatar
  • 143
6 votes
2 answers
11k views

How do I back up YubiKey-backed TOTP authentication?

I bought a YubiKey 5 NFC this week and have started using 2FA and U2F where I can but am deathly allergic to the idea of losing access. For backing up U2F access I'm going to buy a second U2F token (...
mas's user avatar
  • 307