3 ms·
TOTP is one of the supported 2FA method. There's a lot of TOTP implementations that don't require having a separate device. And if you're not happy with any of
by jwilk 4y ago
TOTP is one of the supported 2FA method. There's a lot of TOTP implementations that don't require having a separate device. And if you're not happy with any of them, this is such a simple protocol, you can write your own in one evening.
- blippage 4y agoSo, my understanding so far is that Github (or anyone, in general) will provide a private key consisting of 24 alphanum chars. Github also has a copy of the key. To authenticate, a password is generated based on the private key, which acts as a seed. That seed is combined with a timestamp in order to generate a password, which has an expiry time of about 1 minute. The algorithm that generates the password is a standard one, so once you know the algorithm, you can generate valid passwords. Linux provides "oathtool", which is suitable for such a purpose. Is my understanding correct on this?
- jwilk 4y ago> private key It's a "shared secret". ("private key" implies only one party knows it.) > 24 alphanum chars Hmm, https://datatracker.ietf.org/doc/html/rfc4226#section-4 https://datatracker.ietf.org/doc/html/rfc4226#section-4 says the key "MUST be at least 128 bits", meaning at least 26 (base-32) chars. My current TOTP secret (generated in 2018) for GitHub is only 20 chars. :-/ > Is my understanding correct on this? Yes.