7 ms·

Google Authenticator is an implementation of the catchily-named "Time-based One-Time Password" or TOTP. https://en.wikipedia.org/wiki/Time-based_One-Time_Passw

Google Authenticator is an implementation of the catchily-named "Time-based One-Time Password" or TOTP. https://en.wikipedia.org/wiki/Time-based_One-Time_Password https://en.wikipedia.org/wiki/Time-based_One-Time_Password It is not the only one, any time a site asks you to add a "Google Authenticator" code you can use any TOTP app. 1Password has the functionality built in, for example.

akerl_ 5y ago
The author seems to address this directly: > But here we’re focusing on apps like Google Authenticator that use something called TOTP algorithm. > What we want to achieve is understand how apps like Google Authenticator (or any other TOTP app) are solving that?
ocdtrekkie 5y ago
It's truly and deeply frustrating to me how many sites and services push "Google Authenticator" branding instead of specifying that it's TOTP or that literally any good 2FA app will work. It's almost to that "Google" = "search" level, but for a more niche aspect.
- loloquwowndueo 5y ago
  Back in the day it was the best-known and most reliably available cross-platform (iOS, android) code generator - so many sites just assume it as a de facto standard. It also reduces support burden to tell people this is the officially supported code generator, that way you don’t need to struggle understanding why a random app might be having trouble with codes. These days it’s much less of an issue as there are many more clients - the IdP I manage now mentions authy, tofu and 1password as also supported.
  - tinus_hn 5y ago
    Also Google Authenticator does not allow you to include your codes in your backup, even when it’s encrypted. So due to Google Authenticator, losing your 2fa codes is an expected problem and many companies allow you to reset it by simply calling them. It sounds really secure but it really is not.
    - nanidin 5y ago
      Google Authenticator has a feature to allow export of all saved codes into one QR code for re-import into Google Authenticator running on another device. I printed a copy of my export QR code for use in case my device is lost or stolen.
      - greggman3 5y ago
        Thanks! I hadn't seen that feature. Just checked it out. It shows multiple QR codes (in my case 2 QR codes which contain 11 TOTPs total) that you can scan from another device running Google Authenticator to transfer to codes. I guess I can screenshot those QR goes to back up (scary)
- animex 5y ago
  In Fortune 1000 land, Microsoft Authenticator rules the land. I love it because most have implemented notification push-authentication with biometric verification. Some sites will use that in lieu of any password at all. The worst is when separate apps & companies roll their own authenticator app.
  - maximum_stress 5y ago
    As well it should. It's rare for me to defend Microsoft anything, but in this case I will. MS authenticator happily backs itself up to the cloud if you let it. Whether you consider that good or just another attack vector is up to you, but keep in mind if you switch phones, you'll be setting up TOTP again for every service in Google authenticator.
  - filoleg 5y ago
    For me personally, Microsoft Authenticator started ruling as well recently, after 5+ years with Google Authenticator. Why? I have already mentioned it in other comments before, and it is due to Google’s insistence on not implementing recovery from backup. If i store my 2FA in google authenticator and something happens to my phone? I am in a world of serious pain. If i upgrade phones? I have to disable and re-enable 2FA on my new phone manually for every single service I use. Microsoft Authenticator solves both of those problems, as they have recently (less than a year ago iirc) added a “backup to cloud” feature. No more stressing about something happening to my phone, as long as i have my (single) primary recovery key stored on a piece of paper somewhere safe (as opposed to having a paper recovery key for every 2fa service i use). Prior to this, i was seriously considering getting a cheap backup phone to which i set up all the 2fa codes simultaneously with my main phone, then put that cheap phone in a bank cell/safe/etc., and then rely on it in case something happens to my main phone. That would still not solve the problem of manual transfer and disabling/re-enabling 2fa for every single service, but that would be much better than losing the device. Note: I know Authy exists and had this functionality of cloud syncing 2FA keys between logged in devices for years, but for some irrational reason i was sticking with the “simpler is better, and i somehow trust google more with this one”, but luckily, I trust MSFT with my 2FA no less than i would google, perhaps even moreso. And the biometric 2FA for services that support it (so far, I’ve only seen it used with certain corporate MSFT services) are a nice cherry on top.
- tialaramex 5y ago
  Microsoft's stuff all wants you to install the Microsoft Authenticator which needs a Microsoft account for some reason and that (for me anyway) then immediately wanted me to setup 2FA, for which it required me to install the Microsoft Authenticator, which ... you can see how that goes. As I began to experience Déjà vu on the first day of a new job I snapped out of it, removed the Microsoft Authenticator and told it nah, I'm OK actually, show me that QR code for "other authenticators" and never looked back.
  - jaywalk 5y ago
    Microsoft Authenticator is more than just TOTP, which is why it wants a Microsoft account. It also supports push approvals.
    - greggman3 5y ago
      I'm a little surprised Google hasn't don't this but I guess they have give gmail. Sign into google and it will ask me to approve on my gmail app. Not entirely sure I like these "authenticate on from another device". Just yesterday I mis-placed my phone. I wanted to sign into iCloud.com for use "find my phone" feature from my PC. It required me to use apple's authentication via a code sent to the phone, the exact thing I was looking for! :(
- ezekg 5y ago
  I'm not sure why you're being down voted, but I agree. I've had several discussions where people think Authy is incompatible with sites that prompt for Google Authenticator, like it's some special more-secure TOTP app.
- unclebucknasty 5y ago
  It's about the perception of security and reducing friction. Everyone knows Google, so you don't have to convince users of the trustworthiness of a lesser-known brand or open source project within the sensitive context of increasing security.
  - fraa-orolo 5y ago
    Have you seen users? I have to convince users not to install random crap.
- pilsetnieks 5y ago
  On the one hand, I agree but on the other, this is the one case where you cannot take any chance of having your user install some random dodgy app that promises the same functionality.
willis936 5y ago
You can even convert TOTP from 2FA into 1.5ish FA by using a password manager that stores the TOTP secret and generates the TOTP key from it.
- Godel_unicode 5y ago
  An adversary still has to get the manager DB and the key to unlock it (your password manager DB is encrypted with a key, right?).
  - willis936 5y ago
    What's the point of using a key? That doesn't add a second factor of authentication. Something you have and something else you have is 1FA. A password with more than 200 bits of entropy seems reasonable.
    - maxerickson 5y ago
      They key doesn't particularly increase the security of the authentication, but it helps a bit if you lose control of the device the db is stored on.
      - willis936 5y ago
        Yeah but a key without a second factor (something you know) is still better than a key. Just make sure your password isn't brute forceable.
    - Godel_unicode 5y ago
      Firstly, while that's technically correct according to the CISSP, it's obviously not actually correct. Two different things I have can absolutely be two factors as long as they are not susceptible to the same method of compromise. 1+1=2. Secondly, many password vaults refer to the master password you use to unlock it as the key. Thirdly, many security keys require a pin or similar to be used.
tshaddox 5y ago
I use 1Password for all of my MFA codes on the web. It's extremely convenient to have them synced across all my devices, but I can't help but think that having my passwords and my MFA private keys stored in the same place almost entirely defeats the purpose of multi-factor authentication.
- easton 5y ago
  There is still a little bit of a point, as it guarantees the password came out of 1Password and wasn't from somewhere else. If someone screencapped your password out of 1Password, it wouldn't of use unless they could get into your vault somehow.
- jeromegv 5y ago
  If your passwords are leaked in a data leak, they still wouldn't get your 2FA. So I wouldn't say it entirely defeats the purpose of 2FA.
  - deleted 5y ago
    [deleted]
  - tialaramex 5y ago
    Depending on the leak, the secret that drives TOTP could also be in the same database table (or a nearby one). This means anybody with that secret can trivially run the TOTP algorithm and get the correct six digit code for any time present or future. If you care about MFA that can survive leaks, you want WebAuthn. As with phishing this known problem was considered in the design of WebAuthn and so your WebAuthn credentials aren't designed to need to be secret. In fact here you go, here are WebAuthn credentials for a vanity system I own, copied out of its authentication database: ID: AXnUJ920FfJlRjZtocN+9Bc9IP6gvsBiWA3GfJxckh3nQ/KekQ6xB2byfI2GM7IcGS2MpzxZs6IHmAxvgAcE/Mw= Public key: pQECAyYgASFYIFf0iDSfNpYNA5Br9zXSIUH69BqyvFcgbqy6tWC8rsLwIlggCDqury9UOzI1DnOFyE3aYwaBLvP0NyNez98v0TcieKs= That's all the backend needs to check I'm really me, and yet it's also completely useless to an attacker, they can't even use it to compare across sites and "unmask" me.
    - 5y ago
kaladin-jasnah 5y ago
Have to chime in but my favourite authenticator is andOTP. Seems to be FOSS as well since it's on F-Droid[0] and I hear it has good support from migration from one phone/ROM to another. [0] https://f-droid.org/en/packages/org.shadowice.flocke.andotp/ https://f-droid.org/en/packages/org.shadowice.flocke.andotp/
- teekert 5y ago
  AndOTP is really nice. It is the one thing I miss on iOS. On iOS there does not seem to be any totp apps that can just export their db as an encrypted file (or unencrypted if you so choose). So in Apple land I’m stuck with MS Authenticator, coincidentally my only app that needs iCloud (I really want it backed up).
  - commoner 5y ago
    Raivo is an iOS TOTP authenticator that is open source and supports exports. Hopefully, this is what you're looking for: https://apps.apple.com/us/app/raivo-otp/id1459042137 https://apps.apple.com/us/app/raivo-otp/id1459042137 https://github.com/raivo-otp/ios-application https://github.com/raivo-otp/ios-application
    - AnonC 5y ago
      To add something about this app, I know that people understand “open source” to mean different things. In the case of Raivo, the app is a “source available” one. It’s not FOSS. The license [1] says: > Modification, duplication or distribution of this Service (in source and binary forms) for any purpose is strictly prohibited. [1]: https://github.com/raivo-otp/ios-application/blob/master/LICENSE.md https://github.com/raivo-otp/ios-application/blob/master/LIC...
      - commoner 5y ago
        You're 100% right. Raivo is source-available, but not free (libre) or open source. I found it through a forum post and neglected to check the license.
judge2020 5y ago
Unfortunately, Stripe does this currently: https://i.judge.sh/youthful/Derpy/chrome_TIDNqlcRvI.png https://i.judge.sh/youthful/Derpy/chrome_TIDNqlcRvI.png
jvanderbot 5y ago
You can use oathtool if you'd like to "do it yourself". I usually just keep (encrypted with Pass) my secret keys for Authenticators, and execute a one line alias: oathtool -b --totp `pass show <X>` ... for <X> in github, gmail, blizzard, whatever ... This way, you can have a backup in case your phone gets lost, and easily port between phones.
- stevekemp 5y ago
  If you're using pass already you could use their OTP plugin: https://github.com/tadfisher/pass-otp https://github.com/tadfisher/pass-otp That gives you "pass otp github.com", etc. You can also export the QRcode, and do similar things. I put together a simple distribution of pass with a couple of plugins I use, including otp, which is easy to setup - just clone beneath `/opt/pass`: https://github.com/skx/pass https://github.com/skx/pass
  - jvanderbot 5y ago
    Great tip thanks!
werid 5y ago
at one point i used a python script to provide a totp response to google when using youtube-dl (before logging in became broken and had to switch to cookies) import onetimepass as otp my_secret = '' my_token = otp.get_totp(my_secret) print my_token
jillesvangurp 5y ago
It's really easy to integrate into websites as well. I did so a few years ago. The TOTP algorithm is just a few lines of code. I adapted this implementation https://github.com/j256/two-factor-auth https://github.com/j256/two-factor-auth at the time. There are similar libraries available for lots of languages. You need a library like that and a way to convert an otp:// url into a QR code, for which there are many libaries as well. The rest is just implementing a sane UX around this. Storing the user's TOTP secret server side is a bit tricky. I suspect a plain text field in a database is quite common for this; which of course would be disastrous if that database were ever stolen. Secret stores don't scale for this as they tend to be designed for just a handful of secrets. We ended up encrypting these totp secrets using a key from our secret store.

akerl_ 5y ago

The author seems to address this directly: > But here we’re focusing on apps like Google Authenticator that use something called TOTP algorithm. > What we want to achieve is understand how apps like Google Authenticator (or any other TOTP app) are solving that?

ocdtrekkie 5y ago

It's truly and deeply frustrating to me how many sites and services push "Google Authenticator" branding instead of specifying that it's TOTP or that literally any good 2FA app will work. It's almost to that "Google" = "search" level, but for a more niche aspect.

loloquwowndueo 5y ago
Back in the day it was the best-known and most reliably available cross-platform (iOS, android) code generator - so many sites just assume it as a de facto standard. It also reduces support burden to tell people this is the officially supported code generator, that way you don’t need to struggle understanding why a random app might be having trouble with codes. These days it’s much less of an issue as there are many more clients - the IdP I manage now mentions authy, tofu and 1password as also supported.
- tinus_hn 5y ago
  Also Google Authenticator does not allow you to include your codes in your backup, even when it’s encrypted. So due to Google Authenticator, losing your 2fa codes is an expected problem and many companies allow you to reset it by simply calling them. It sounds really secure but it really is not.
  - nanidin 5y ago
    Google Authenticator has a feature to allow export of all saved codes into one QR code for re-import into Google Authenticator running on another device. I printed a copy of my export QR code for use in case my device is lost or stolen.
    - greggman3 5y ago
      Thanks! I hadn't seen that feature. Just checked it out. It shows multiple QR codes (in my case 2 QR codes which contain 11 TOTPs total) that you can scan from another device running Google Authenticator to transfer to codes. I guess I can screenshot those QR goes to back up (scary)
animex 5y ago
In Fortune 1000 land, Microsoft Authenticator rules the land. I love it because most have implemented notification push-authentication with biometric verification. Some sites will use that in lieu of any password at all. The worst is when separate apps & companies roll their own authenticator app.
- maximum_stress 5y ago
  As well it should. It's rare for me to defend Microsoft anything, but in this case I will. MS authenticator happily backs itself up to the cloud if you let it. Whether you consider that good or just another attack vector is up to you, but keep in mind if you switch phones, you'll be setting up TOTP again for every service in Google authenticator.
- filoleg 5y ago
  For me personally, Microsoft Authenticator started ruling as well recently, after 5+ years with Google Authenticator. Why? I have already mentioned it in other comments before, and it is due to Google’s insistence on not implementing recovery from backup. If i store my 2FA in google authenticator and something happens to my phone? I am in a world of serious pain. If i upgrade phones? I have to disable and re-enable 2FA on my new phone manually for every single service I use. Microsoft Authenticator solves both of those problems, as they have recently (less than a year ago iirc) added a “backup to cloud” feature. No more stressing about something happening to my phone, as long as i have my (single) primary recovery key stored on a piece of paper somewhere safe (as opposed to having a paper recovery key for every 2fa service i use). Prior to this, i was seriously considering getting a cheap backup phone to which i set up all the 2fa codes simultaneously with my main phone, then put that cheap phone in a bank cell/safe/etc., and then rely on it in case something happens to my main phone. That would still not solve the problem of manual transfer and disabling/re-enabling 2fa for every single service, but that would be much better than losing the device. Note: I know Authy exists and had this functionality of cloud syncing 2FA keys between logged in devices for years, but for some irrational reason i was sticking with the “simpler is better, and i somehow trust google more with this one”, but luckily, I trust MSFT with my 2FA no less than i would google, perhaps even moreso. And the biometric 2FA for services that support it (so far, I’ve only seen it used with certain corporate MSFT services) are a nice cherry on top.
tialaramex 5y ago
Microsoft's stuff all wants you to install the Microsoft Authenticator which needs a Microsoft account for some reason and that (for me anyway) then immediately wanted me to setup 2FA, for which it required me to install the Microsoft Authenticator, which ... you can see how that goes. As I began to experience Déjà vu on the first day of a new job I snapped out of it, removed the Microsoft Authenticator and told it nah, I'm OK actually, show me that QR code for "other authenticators" and never looked back.
- jaywalk 5y ago
  Microsoft Authenticator is more than just TOTP, which is why it wants a Microsoft account. It also supports push approvals.
  - greggman3 5y ago
    I'm a little surprised Google hasn't don't this but I guess they have give gmail. Sign into google and it will ask me to approve on my gmail app. Not entirely sure I like these "authenticate on from another device". Just yesterday I mis-placed my phone. I wanted to sign into iCloud.com for use "find my phone" feature from my PC. It required me to use apple's authentication via a code sent to the phone, the exact thing I was looking for! :(
ezekg 5y ago
I'm not sure why you're being down voted, but I agree. I've had several discussions where people think Authy is incompatible with sites that prompt for Google Authenticator, like it's some special more-secure TOTP app.
unclebucknasty 5y ago
It's about the perception of security and reducing friction. Everyone knows Google, so you don't have to convince users of the trustworthiness of a lesser-known brand or open source project within the sensitive context of increasing security.
- fraa-orolo 5y ago
  Have you seen users? I have to convince users not to install random crap.
pilsetnieks 5y ago
On the one hand, I agree but on the other, this is the one case where you cannot take any chance of having your user install some random dodgy app that promises the same functionality.

willis936 5y ago

You can even convert TOTP from 2FA into 1.5ish FA by using a password manager that stores the TOTP secret and generates the TOTP key from it.

Godel_unicode 5y ago
An adversary still has to get the manager DB and the key to unlock it (your password manager DB is encrypted with a key, right?).
- willis936 5y ago
  What's the point of using a key? That doesn't add a second factor of authentication. Something you have and something else you have is 1FA. A password with more than 200 bits of entropy seems reasonable.
  - maxerickson 5y ago
    They key doesn't particularly increase the security of the authentication, but it helps a bit if you lose control of the device the db is stored on.
    - willis936 5y ago
      Yeah but a key without a second factor (something you know) is still better than a key. Just make sure your password isn't brute forceable.
  - Godel_unicode 5y ago
    Firstly, while that's technically correct according to the CISSP, it's obviously not actually correct. Two different things I have can absolutely be two factors as long as they are not susceptible to the same method of compromise. 1+1=2. Secondly, many password vaults refer to the master password you use to unlock it as the key. Thirdly, many security keys require a pin or similar to be used.

tshaddox 5y ago

I use 1Password for all of my MFA codes on the web. It's extremely convenient to have them synced across all my devices, but I can't help but think that having my passwords and my MFA private keys stored in the same place almost entirely defeats the purpose of multi-factor authentication.

easton 5y ago
There is still a little bit of a point, as it guarantees the password came out of 1Password and wasn't from somewhere else. If someone screencapped your password out of 1Password, it wouldn't of use unless they could get into your vault somehow.
jeromegv 5y ago
If your passwords are leaked in a data leak, they still wouldn't get your 2FA. So I wouldn't say it entirely defeats the purpose of 2FA.
- deleted 5y ago
  [deleted]
- tialaramex 5y ago
  Depending on the leak, the secret that drives TOTP could also be in the same database table (or a nearby one). This means anybody with that secret can trivially run the TOTP algorithm and get the correct six digit code for any time present or future. If you care about MFA that can survive leaks, you want WebAuthn. As with phishing this known problem was considered in the design of WebAuthn and so your WebAuthn credentials aren't designed to need to be secret. In fact here you go, here are WebAuthn credentials for a vanity system I own, copied out of its authentication database: ID: AXnUJ920FfJlRjZtocN+9Bc9IP6gvsBiWA3GfJxckh3nQ/KekQ6xB2byfI2GM7IcGS2MpzxZs6IHmAxvgAcE/Mw= Public key: pQECAyYgASFYIFf0iDSfNpYNA5Br9zXSIUH69BqyvFcgbqy6tWC8rsLwIlggCDqury9UOzI1DnOFyE3aYwaBLvP0NyNez98v0TcieKs= That's all the backend needs to check I'm really me, and yet it's also completely useless to an attacker, they can't even use it to compare across sites and "unmask" me.
  - 5y ago

kaladin-jasnah 5y ago

Have to chime in but my favourite authenticator is andOTP. Seems to be FOSS as well since it's on F-Droid[0] and I hear it has good support from migration from one phone/ROM to another. [0] https://f-droid.org/en/packages/org.shadowice.flocke.andotp/ https://f-droid.org/en/packages/org.shadowice.flocke.andotp/

teekert 5y ago
AndOTP is really nice. It is the one thing I miss on iOS. On iOS there does not seem to be any totp apps that can just export their db as an encrypted file (or unencrypted if you so choose). So in Apple land I’m stuck with MS Authenticator, coincidentally my only app that needs iCloud (I really want it backed up).
- commoner 5y ago
  Raivo is an iOS TOTP authenticator that is open source and supports exports. Hopefully, this is what you're looking for: https://apps.apple.com/us/app/raivo-otp/id1459042137 https://apps.apple.com/us/app/raivo-otp/id1459042137 https://github.com/raivo-otp/ios-application https://github.com/raivo-otp/ios-application
  - AnonC 5y ago
    To add something about this app, I know that people understand “open source” to mean different things. In the case of Raivo, the app is a “source available” one. It’s not FOSS. The license [1] says: > Modification, duplication or distribution of this Service (in source and binary forms) for any purpose is strictly prohibited. [1]: https://github.com/raivo-otp/ios-application/blob/master/LICENSE.md https://github.com/raivo-otp/ios-application/blob/master/LIC...
    - commoner 5y ago
      You're 100% right. Raivo is source-available, but not free (libre) or open source. I found it through a forum post and neglected to check the license.

judge2020 5y ago

Unfortunately, Stripe does this currently: https://i.judge.sh/youthful/Derpy/chrome_TIDNqlcRvI.png https://i.judge.sh/youthful/Derpy/chrome_TIDNqlcRvI.png

jvanderbot 5y ago

You can use oathtool if you'd like to "do it yourself". I usually just keep (encrypted with Pass) my secret keys for Authenticators, and execute a one line alias: oathtool -b --totp `pass show <X>` ... for <X> in github, gmail, blizzard, whatever ... This way, you can have a backup in case your phone gets lost, and easily port between phones.

stevekemp 5y ago
If you're using pass already you could use their OTP plugin: https://github.com/tadfisher/pass-otp https://github.com/tadfisher/pass-otp That gives you "pass otp github.com", etc. You can also export the QRcode, and do similar things. I put together a simple distribution of pass with a couple of plugins I use, including otp, which is easy to setup - just clone beneath `/opt/pass`: https://github.com/skx/pass https://github.com/skx/pass
- jvanderbot 5y ago
  Great tip thanks!

werid 5y ago

at one point i used a python script to provide a totp response to google when using youtube-dl (before logging in became broken and had to switch to cookies) import onetimepass as otp my_secret = '' my_token = otp.get_totp(my_secret) print my_token

jillesvangurp 5y ago

It's really easy to integrate into websites as well. I did so a few years ago. The TOTP algorithm is just a few lines of code. I adapted this implementation https://github.com/j256/two-factor-auth https://github.com/j256/two-factor-auth at the time. There are similar libraries available for lots of languages. You need a library like that and a way to convert an otp:// url into a QR code, for which there are many libaries as well. The rest is just implementing a sane UX around this. Storing the user's TOTP secret server side is a bit tricky. I suspect a plain text field in a database is quite common for this; which of course would be disastrous if that database were ever stolen. Secret stores don't scale for this as they tend to be designed for just a handful of secrets. We ended up encrypting these totp secrets using a key from our secret store.