5 ms·
All it requires is the initial setup key and a somewhat accurate (~30s) time source. Give https://en.wikipedia.org/wiki/Time-based_one-time_password#Algorithm
by proto_lambda 3y ago
All it requires is the initial setup key and a somewhat accurate (~30s) time source.
Give https://en.wikipedia.org/wiki/Time-based_one-time_password#Algorithm https://en.wikipedia.org/wiki/Time-based_one-time_password#A... a read, it's extremely simple.
- badsectoracula 3y agoThanks, i took a look in the page and it looks quite simple. One question i have would be that it mentions: > TOTP credentials are also based on a shared secret known to both the client and the server AFAICT this "shared secret" is something that is shared between the service you want to authenticate with (e.g. PyPI) and "you" (your password manager, TOTP client or whatever), right? In which case i guess this sounds something like it can be done fully locally indeed.
- proto_lambda 3y agoYes, I don't know of any TOTP authenticator that doesn't work fully locally (disregarding things like key backups).
- badsectoracula 3y agoI did use Authy once for a service i used for a bit but it required me to put my phone online every time[0] i tried to authenticate because otherwise the authentication would fail, so the association Authy=TOTP made me think a reliance on a 3rd party service is required and the page mentioning only mobile phone apps also made me think there is also some sort of reliance on mobile phones. [0] I have a very old Android phone that i always keep offline
- zeroimpl 3y agoAuthy also supports their own auth system that isn’t TOTP but rather a server-push model which requires your device to be online to receive the token.