Luckily, TOTP 2FA gets simpler after the initial registration process. Compare that to SMS 2FA, where Alice only needs to enter her phone number and manually type a code into her browser. The first time Alice ever sets up TOTP 2FA, she will need to download a new app to her trusted device, use that app to scan a QR code, and manually type the current OTP into her browser. It would be quite fair to say that TOTP 2FA registration is more complicated than SMS 2FA. This allows the service provider to verify that it is the correct OTP and enable TOTP 2FA on Alice’s account. To complete the TOTP 2FA registration process, Alice types the current OTP displayed on her trusted device into her browser. These are typically 6 digits long and change every 30 seconds or so. Hold tight! Let’s not get ahead of ourselves.Īfter scanning the QR code, the authenticator app starts automatically generating OTPs for Alice’s account. I’m sure your “someone is gonna steal it!” sense is tingling already. Second, the value is secret only Alice and the service provider should ever have access to it. First, the value is shared Alice has a copy and the service provider has a copy. This shared secure is foundational in how TOTP works and I will explain how later on, but there are two simple things to highlight here. Here is a screenshot of the Google Authenticator app:Īfter installing the authenticator app, Alice uses it to scan the QR code displayed in her browser, which saves a shared secret onto her trusted device. Alice chooses one of these and installs it from her trusted device’s app store. For example, Google Authenticator, Authy, Duo Mobile, Auth0 Guardian, and FreeOTP are all capable of generating OTPs in the same exact way. There are many apps available that implement the TOTP specification. If Alice does not already have an authenticator app, then she must install one before continuing. Let’s start off by taking a look at the registration workflow by way of a diagram! A picture is worth a thousand words, right?Īfter Alice starts the 2FA registration process, the service provider displays a QR code in Alice’s browser and prompts her to scan it with an authenticator app on her trusted device. Throughout this article, we will be following Alice, our recurring friend, as she navigates the TOTP 2FA workflows. Let’s get into it! Registration flow for first time TOTP 2FA users Typically, a trusted device is a smartphone or tablet, but can also include desktops, laptops, smart watches, etc.Īnd finally, a quick reminder that the authentication factors associated with 2FA are the knowledge factor (something you know) and the possession factor (something you have). trusted device to refer to any device capable of running an authenticator app that can generate OTPs according to the TOTP specification, such as Google Authenticator.service provider to refer to the website service provider (e.g., Google, Facebook, Twitter, etc.).I will be using the following terms throughout this post: We’ll use the abbreviation TOTP 2FA as we cover the technical details, highlight security vulnerabilities, and discuss usability tradeoffs.Ī few administrative things to clear up before we dive in. In this article, we are going to cover the common time-based one-time passwords (TOTP) implementation of 2FA. Have you ever heard of these apps or wondered how they actually work? Well, today you’ll find out! One of those methods is using Google Authenticator or a similar app on your phone to generate 2FA codes. The previous article in the series outlines why you should favor more secure 2FA methods than SMS if at all possible. If you haven’t already, check out the first article in the series that explains what 2FA is and why you really should enable it on your accounts (yes, even if you have a strong, unique password). Welcome back to the two factor authentication (2FA) series!

Apps with totp authentication