3 ms·
Does TOTP rely on some external service though or can it be done fully locally? AFAIK a benefit of private+public key signatures is that it can all be done with
by badsectoracula 3y ago
Does TOTP rely on some external service though or can it be done fully locally? AFAIK a benefit of private+public key signatures is that it can all be done without reliance on 3rd parties.
- proto_lambda 3y agoAll it requires is the initial setup key and a somewhat accurate (~30s) time source. Give https://en.wikipedia.org/wiki/Time-based_one-time_password#Algorithm https://en.wikipedia.org/wiki/Time-based_one-time_password#A... a read, it's extremely simple.
- badsectoracula 3y agoThanks, i took a look in the page and it looks quite simple. One question i have would be that it mentions: > TOTP credentials are also based on a shared secret known to both the client and the server AFAICT this "shared secret" is something that is shared between the service you want to authenticate with (e.g. PyPI) and "you" (your password manager, TOTP client or whatever), right? In which case i guess this sounds something like it can be done fully locally indeed.
- proto_lambda 3y agoYes, I don't know of any TOTP authenticator that doesn't work fully locally (disregarding things like key backups).
- badsectoracula 3y agoI did use Authy once for a service i used for a bit but it required me to put my phone online every time[0] i tried to authenticate because otherwise the authentication would fail, so the association Authy=TOTP made me think a reliance on a 3rd party service is required and the page mentioning only mobile phone apps also made me think there is also some sort of reliance on mobile phones. [0] I have a very old Android phone that i always keep offline
- zeroimpl 3y agoAuthy also supports their own auth system that isn’t TOTP but rather a server-push model which requires your device to be online to receive the token.
- arp242 3y agoNo third parties are involved. You get a secret (often presented in the form of a QR code, but most implementations also have it as text) which you store and generate short-lived secret messages based on that and the current time, which is the code you enter. The server also knows the secret and can verify you sent the correct message. That's pretty much all there is to it. It's really simple; I once wrote an implementation in Python in 20 lines or so based on just the specification, and I'm not a crypto guy at all. It's probably the simplest crypto systems to implement. Things like "connect your authentication app" make it sound complicated, but all that does is store a short secret in the app. One clear advantage of this is that a code is only valid for a short period of time (usually a few minutes at the most). I can't re-use the code you used yesterday, and intercepting codes is also much harder as it's much more time-sensitive.
- badsectoracula 3y agoYeah, the more i read about it the better it sounds and the more it seems that i had a misunderstanding about it. Perhaps i'll try implementing it once to see exactly what it is.
- boneitis 3y agoSibling posts have pretty much answered it already. If you want to really overgeneralize it, it blew my mind a mere few weeks ago when I finally came to the realization after all these years that TOTP is nothing more than an initial seed value, as one half, combined with the current time as the other seed half. I had a huge jackie chan meme moment at that point. Then I realized that, all along, my password manager has a feature to store TOTP, and there is not even a strict need to use all these authenticator apps. (Of course, as someone who strives to exercise some security mindfulness, I reckon it undermines much of the overall point of TOTP to keep it within the same datastore as your account password.)
- badsectoracula 3y agoYeah the more i read the comments the better TOTP sounds.