google-authenticator

Six-digit verification codes for something like a "forgot password" flow are OTPs -- they're only good for one login -- but they are not HOTP/TOTPs. HOTP/TOTP has a registration step, where you copy a server-generated secret to your phone through a QR-code-encoded otpauth:// URI (https://github.com/google/google-authenticator/wiki/Key-Uri-...). That doesn't happen in a "forgot password" flow. Incidentally, if you think of TOTP as being HMAC(unix mod 30, secret), one idea would be to do public key crypto instead of symmetric HMAC stuff. That's basically what a security key is. If you additionally made it so that you couldn't phish the security key -- by having the OS + web browser know which apps can ask for which security keys -- you'd have reinvented WebAuthn. P.S.: Make you sure you have stuffing protection in place against these kinds

I don't think there's a formal spec for the otpauth URI yet [0], even if there is a spec by Google [1], so this may just come down to MS adding some incompatibility to force usage of their authenticator, or the app using some proprietary authentication scheme that is not otpauth. There's nothing complicated about otpauth provisioning URIs i.e. what's encoded into the QR code. [0]: https://shkspr.mobi/blog/2022/05/why-is-there-no-formal-spec... [1]: https://github.com/google/google-authenticator/wiki/Key-Uri-...

otpauth:// is a de-facto standard, since Google Authenticator uses it: https://github.com/google/google-authenticator/wiki/Key-Uri-... The TOTP QR codes decode to one of these URIs

Seriously, the QR is just a URI that any QR reader can decode (preferably one you trust). https://github.com/google/google-authenticator/wiki/Key-Uri-...

TOTP/HOTP codes are defined by an algorithm (sha1/md5/...), secret (A826EF8...), and number of digits (I usually see 6 digit codes). TOTP additionally takes time period (30 second codes) and time (current time which maps to some 30 second block) as a parameter and HOTP takes a counter as a parameter. All of these parameters go into the function to generate the numbers as a result. If you have ever set one of these up with a QR code, that QR scans to something like: otpauth://totp/ACME%20Co:john.doe@email.com?secret=HXDMVJECJJWSRB3HWIZR4IFUGFTMXBOZ&issuer=ACME%20Co&algorithm=SHA1&digits=6&period=30 (From: https://github.com/google/google-authenticator/wiki/Key-Uri-...). Notice all parameters I mentioned above are present, as well as a user friendly account name. So to directly answer your question: a backup would in some way contain all th

https://github.com/google/google-authenticator/wiki/Key-Uri-... That's the format that gets encoded into the QR code. If you can decode the QR code you can get the secret key easily.

Whoa. TIL https://github.com/google/google-authenticator/wiki/Key-Uri-...

If you're truly paranoid, TOTP and HOTP are absurdly easy to implement if you've got an HMAC primitive: https://en.wikipedia.org/wiki/HMAC-based_One-time_Password_a... https://en.wikipedia.org/wiki/Time-based_One-time_Password_a... https://github.com/google/google-authenticator/wiki/Key-Uri-...

I have read about this a little from the user POV, but I have not yet used Authy to build a service which provides 2FA, so I do not understand the details enough to really talk intelligently about the differences. I do recall reading that Authy uses SHA256 and 7 digit codes instead of SHA1 and 6 digit codes like Google Authenticator (cannot find source). However, the Key URI Format documentation in the Google Authenticator project [1] does have optional support for SHA256 and configurable number of digits, so Google Authenticator could support that too if it wanted to. [1] https://github.com/google/google-authenticator/wiki/Key-Uri-...

Google Authenticator, the one that you download from Play Store, is not open source: > These apps are not on the app stores, and their code has diverged from what's in the app stores, so patches here won't necessarily show up in those versions. Source: https://github.com/google/google-authenticator/blob/master/R...

I also use Google Authenticator but find the UI breaks down after a dozen accounts (I have 30+). 1 Password also supports adding TOTP but that sort of violates separating password from the second factor…so I use it only for accounts whose loss would be annoying but not devastating. I keep manual backups of the TOTP codes for all accounts, using a QR reader to decode the QR code they give out and saving the result in an encrypted file. A variant of the Google Authenticator source code is available at https://github.com/google/google-authenticator but is not what's on the iOS/Android app stores.

I am looking for something like this: https://www.vasco.com/products/two-factor-authenticators/hardware/one-button/digip… that doesn't require paying high fees for the authentication server. Google provides an open source authenticator server, I am looking for the client part implemented in hardware that works with it. https://github.com/google/google-authenticator I know about Yubico but their tokens don't come with a led display, you need to plug them to a USB port which it's an issue if you want to log in from your phone.

I have. But TOTP is a bit tricky: A generated password isn't single use by design (as it's valid for 30 second window). So you'd have to make sure a single password can be only used once on the server side. Additionally the default 6 digit code seems a bit weak. It seems that 6 digits is fixed in Google Authenticator at the moment: https://github.com/google/google-authenticator/wiki/Key-Uri-.... HOTP might also be possible, but then you also have to store state (the counter) on the server side. Additionally that also seems to be limited to 6 digits in Google Authenticator. My current approach is: Don't exhaust the tokens before you return from vacation :-)