Collaborate Disseminate
On a phone with Authy backup enabled, if I disable backups, what happens to existing encrypted backups on Authy servers?
What do folks think about turning on multidevice & backups only to setup new device or additional … Continue reading Question about Authy backup
Reddit.com today disclosed that a data breach exposed some internal data, as well as email addresses and passwords for some Reddit users. As Web site breaches go, this one doesn’t seem too severe. What’s interesting about the incident is that it showca… Continue reading Reddit Breach Highlights Limits of SMS-Based Authentication
Reading about TOTP-based authentication systems that use smartphones as one-time code generators, I seem to understand that typically the shared secret is generated automatically by the “server” (the system to which the user … Continue reading Is it a bad idea to have the user choose the TOTP secret instead of generating it automatically?
I would like to buy a device that can be provisioned with a secret seed and then displays a time based authentication token without ever revealing the seed.
As terms like 2FA, TOTP and Authenticator are almost guaranteed to only show up i… Continue reading What are dedicated TOTP devices called?
I’ve been reading about 2FA and how it is used, and the thing that struck me most is that everyone seems to be storing the TOTP secret as plaintext in their database.
I understand you need the secret as plaintext in order to verify the OT… Continue reading Storing TOTP secret in database, plaintext or encrypted?
I was just reading around and found it really fascinating that Authy can use Google Authenticator implementations anywhere.
How does Authy does this? Isn’t this a security risk?
I am earning money by mining crypto currencies. I am using long and strong enough passwords, but it feels like it is not the safest way to protect my virtual wallet and mining pool accounts from hackers. So I have decided to … Continue reading Which Form of Two-Factor Authentication Should I Use?
Google Authenticator is a particularly popular smartphone application that can be used as a token for many two factor authentication (2FA) systems by generating a time-based one time password (referred to as TOTP). With Google Authenticator, the combination of your user name and password along with the single-use code generated by the application allows you to securely authenticate yourself in a way that would be difficult for an attacker to replicate.
That sounds great, but what if you don’t have a smartphone? That’s the situation that [Lada Ada] recently found herself in, and rather than going the easy route and …read more
I’m most accustomed to using Google Authenticator / FreeOTP for my 2FA needs. This system allows me to have separate TOTP streams for each site and allows me to backup my seeds (by printing the QR codes used to set them up)…. Continue reading Using the Symantec VIP Access smartphone software for 2FA
What happens if for some reason a cell phones clock / calendar is off by a significant amount of time? Does the TOTP (Time-based OTP) algorithm generate an invalid token? Also, do time zones play a role in the token being c… Continue reading Does the TOTP Algorithm rely on the client time always being synced correctly?
