3 ms·

I meant “download the totp generator”. Correct me if I’m wrong but the totp generator has to linked with some account, the security of which is not managed by y

I meant “download the totp generator”. Correct me if I’m wrong but the totp generator has to linked with some account, the security of which is not managed by you, and is just as vulnerable as that account

peeters 3y ago
TOTP is a completely offline protocol. Basically you scan a QR code which is a signing key that is saved to your phone. Then all your phone needs is an accurate time source, and periodically signs the current time with that key to produce a 6-digit code. As such, no, it's not associated with anything from the source account. It is not challenge/response, and you can scan the QR code with 10 different phones and they will all produce the same codes at the same time.
kevincox 3y ago
No, TOTP is a cryptographic protocol for generating One Time Passcodes (OTP) based on a seed. Frequently this seed is displayed to the user as a QR code, but it is just a random string. The user will then somehow save this seed (usually by scanning the QR code with their TOTP app). When a password is required you just use the seed and the current time to generate a code. No accounts are required, just the current time and the seed. You may be confusing TOTP with proprietary app-based 2FA solutions which just send the token in a push notification or similar.
- baerrie 3y ago
  Okay, thanks, now i get it i think
  - neilv 3y ago
    The TOTP authenticator apps are usually initialized only once per account -- when the user first enables that 2FA for the account. The system is designed to assume that the user doing the initializing that one time is the legitimate user. (There's a bootstrapping problem for the authenticators, that the account provider needs to "trust once" that the user is legitimate. The best time to do that is as early as possible. Preferably when the account is set up, and before much value/dependence has been invested in the account.) After that first initialization of an authenticator for an account, anyone trying to initialize another authenticator would have the burden of trying to prove to the account provider that they aren't just an illegitimate person trying to bypass the 2FA. So, you probably can't just use email to do a "lost my authenticator lol", unless the account provider doesn't really care about 2FA, and has implemented it in a very weak way.

peeters 3y ago

TOTP is a completely offline protocol. Basically you scan a QR code which is a signing key that is saved to your phone. Then all your phone needs is an accurate time source, and periodically signs the current time with that key to produce a 6-digit code. As such, no, it's not associated with anything from the source account. It is not challenge/response, and you can scan the QR code with 10 different phones and they will all produce the same codes at the same time.

kevincox 3y ago

No, TOTP is a cryptographic protocol for generating One Time Passcodes (OTP) based on a seed. Frequently this seed is displayed to the user as a QR code, but it is just a random string. The user will then somehow save this seed (usually by scanning the QR code with their TOTP app). When a password is required you just use the seed and the current time to generate a code. No accounts are required, just the current time and the seed. You may be confusing TOTP with proprietary app-based 2FA solutions which just send the token in a push notification or similar.

baerrie 3y ago
Okay, thanks, now i get it i think
- neilv 3y ago
  The TOTP authenticator apps are usually initialized only once per account -- when the user first enables that 2FA for the account. The system is designed to assume that the user doing the initializing that one time is the legitimate user. (There's a bootstrapping problem for the authenticators, that the account provider needs to "trust once" that the user is legitimate. The best time to do that is as early as possible. Preferably when the account is set up, and before much value/dependence has been invested in the account.) After that first initialization of an authenticator for an account, anyone trying to initialize another authenticator would have the burden of trying to prove to the account provider that they aren't just an illegitimate person trying to bypass the 2FA. So, you probably can't just use email to do a "lost my authenticator lol", unless the account provider doesn't really care about 2FA, and has implemented it in a very weak way.