3 ms·
> It seems like getting this to run on an Android would be significantly more functional (no extra device) and cheaper. That’s basically Google Authenticator.
by UncleEntity 4y ago
> It seems like getting this to run on an Android would be significantly more functional (no extra device) and cheaper.
That’s basically Google Authenticator.
Didn’t RTFA as I know the algorithm is just one line of python using built-in libraries (which is how I generate passwords minus the time-based part).
- azornathogron 4y ago> Didn’t RTFA as I know the algorithm is just one line of python using built-in libraries Time-based OTP (TOTP), which is what Google Authenticator implements, is not the same as FIDO U2F. They use different underlying mechanisms and have different security properties. TOTP relies on a shared secret key to generate a matching code on client & server. FIDO U2F uses a challenge-response protocol and incorporates the domain of the requesting website (the domain as verified by TLS certificate) into the challenge to ensure that the response is _only_ valid when it was requested directly from the correct website. This prevents phishing attacks, which TOTP does not.