4 ms·
> The TOTP stuff will never be widly used. Its just a total pain to work with. I'm not sure I agree with that. Generating a code: <?php use ParagonIE\Mui
by CiPHPerCoder 10y ago
> The TOTP stuff will never be widly used. Its just a total pain to work with.
I'm not sure I agree with that.
Generating a code:
<?php
use ParagonIE\MuiltiFactor\Vendor\GoogleAuth;
use ParagonIE\MultiFactor\OTP\TOTP;
$seed = random_bytes(20);
/** Then persist $seed into the database for a user **/
$gauth = new GoogleAuth($seed, new TOTP());
header("Content-Type: image/png");
$gauth->makeQRCode();
Validating a code:
<?php
use ParagonIE\MuiltiFactor\Vendor\GoogleAuth;
use ParagonIE\MultiFactor\OTP\TOTP;
if (\password_verify($_POST['password'], $storedHash)) {
$seed = /** Get seed from database for this user **/;
$gauth = new GoogleAuth($seed, new TOTP());
if ($gauth->validateCode($_POST['2facode'])) {
// Login successful
}
}
Then you can just use the 2FA app of your choice (Authy, Google Authenticator, etc.), scan the QR code, and you're good to go.
- nickik 10y agoI have implemented this before. I have it in production right now. The fact is people hate typing stuff from their phone into their computer. Specially if you phone is not always within reaching distance. If you have to do it with tons of different logins you will be annoyed. As long as you have 1-2 accounts its fine, but if we really want to role it out everywhere, we need something better.
- CiPHPerCoder 10y agoWhat are your thoughts about SQRL?
- nickik 10y agoI don't know enougth about it. I have stumbled on it before, but I need to get into it.
- rahimnathwani 10y agoPeople can get used to it. In China, it's very common to require either (i) entry of a 6-digit code sent by SMS or (ii) using a mobile app to scan a QR code, to complete a web site login. Neither of these things is a barrier.