google-authenticator

I am looking for something like this: https://www.vasco.com/products/two-factor-authenticators/hardware/one-button/digip… that doesn't require paying high fees for the authentication server. Google provides an open source authenticator server, I am looking for the client part implemented in hardware that works with it. https://github.com/google/google-authenticator I know about Yubico but their tokens don't come with a led display, you need to plug them to a USB port which it's an issue if you want to log in from your phone.

I have. But TOTP is a bit tricky: A generated password isn't single use by design (as it's valid for 30 second window). So you'd have to make sure a single password can be only used once on the server side. Additionally the default 6 digit code seems a bit weak. It seems that 6 digits is fixed in Google Authenticator at the moment: https://github.com/google/google-authenticator/wiki/Key-Uri-.... HOTP might also be possible, but then you also have to store state (the counter) on the server side. Additionally that also seems to be limited to 6 digits in Google Authenticator. My current approach is: Don't exhaust the tokens before you return from vacation :-)

AFAIK your Two-Factor is not connected to your google account. Or maybe we're talking about different things. Mine is an app that happens to be made by Google but it has no connection to my google account. If I Google kicked me off the two factor app would keep running https://github.com/google/google-authenticator

Ah, indeed. There's a seperate function for HOTP: https://github.com/google/google-authenticator/blob/3fb90bda... And of course the switch statement that handles the core logic starts by checking scratch codes, and if that doesn't work, proceeds to check TOTP/HOTP: https://github.com/google/google-authenticator/blob/3fb90bda... I'm not a big fan of this style: https://github.com/google/google-authenticator/blob/3fb90bda... But at least there's a comment documenting the magic return code (#DEFINE VALID_SCRATCH_CODE = 0, or an enum, or basically anything else, anyone?): /* Checks for possible use of scratch codes. Returns -1 on error, 0 on success, * and 1, if no scratch code had been entered, and subsequent tests should be * applied. */

From earlier, the google_authenticator pam code/project didn't fill me with confidence, but on the project page it does state it supports "emergency scratch codes" as well as HOTP -- from looking at the code again, I think they are considered the same thing, and it appears if you enter a scratch code, that'll let you log in (and if the code you enter is an invalid scratch code, the system will check to see if it was a valid time-based code): https://github.com/google/google-authenticator/blob/3fb90bda... This older article shows a bit of the hoops one could jump through to get a complete system (including the scratch codes etc): https://www.serverstack.com/blog/2013/02/21/implementing-tot... I've successfully played with the python oath code to get 2fa working with "Star Wars: the Old Republic" (the game has a pretty broken interface for