MTOTP: Wouldn't it be nice if you were the 2FA device?

Post by az09mugen » Tue, Jan 20, 2026, 7:24 AM UTC

fxj wrote: post #24

crote wrote: post #5

What makes this 2FA? It's "something you know, plus mental labor", which makes it a password. 2FA is "something you have" (or ".. you are", for biometrics): it is supposed to prove that you currently physically posses the single copy of a token. The textbook example is a TOTP stored in a Yubikey. Granted, this has been watered down a lot by the way-too-common practice of storing TOTP secrets in password managers, but…

TOTP is also just password + some computation. So where is the difference? There is a lot of security theatre around TOTP with the QR code and then need of an app but you can write a 8 liner in python that does the same when you extract the password out of the QR code. import base64 import hmac import struct import time def totp(key, time_step=30, digits=6, digest='sha1'): key = base64.b32decode(key.upper() + '=' \*…

Post by tatersolid » Tue, Jan 20, 2026, 11:41 AM UTC

istillwritecode wrote: post #95

No. I'm comfortable remembering passwords.

Post by dpoloncsak » Tue, Jan 20, 2026, 2:13 PM UTC

alt227 wrote: post #40

crote wrote: post #30

Earlier quoted context omitted.

You are supposed to store the password in a Secure Enclave, which you can only query for the current token value. You are also supposed to immediately destroy the QR code after importing it. As I already mentioned, the fact that people often use it wrong undermines its security, but that doesn't change the intended outcome.

IMO if it is possible to use a system wrongly which undermines its security, it is already broken.

Post by aja12 » Tue, Jan 20, 2026, 5:47 PM UTC

Rubberducky1324 wrote: post #106

aja12 wrote: post #104

Earlier quoted context omitted.

>Most TOTP apps support backups/restores, which defeats this. Citation needed? Yubico authenticator doesn't (the secure enclave is the Yubikey). I'd be very surprised if MS Authenticator and Authy (which I don't use but are the most popular apps that I know of) support such backups

> Citation needed? Yubico authenticator doesn't (the secure enclave is the Yubikey). I'd be very surprised if MS Authenticator and Authy (which I don't use but are the most popular apps that I know of) support such backups Google Authenticator has an export option that I've used in the past, so that one does it for sure. Authy allows cloud-based synchronization in any case, so exporting seems quite possible. MS Authe…

Post by vel0city » Tue, Jan 20, 2026, 6:41 PM UTC

vel0city wrote: post #97

alphager wrote: post #93

Earlier quoted context omitted.

The 30 seconds (+30-60 seconds to account for clock drift) are long enough to exploit. TOTP is primarily a defense against password reuse (3rd party site gets popped and leaks passwords, thanks to TOTP my site isn't overrun by adversaries) and password stuffing attacks.

In every system I've worked on recent successful TOTPs have been cached as well to validate they're not used more than once.

   Note that a prover may send the same OTP inside a given time-step
   window multiple times to a verifier.  The verifier MUST NOT accept
   the second attempt of the OTP after the successful validation has
   been issued for the first OTP, which ensures one-time only use of an
   OTP.