#twofactor — Public Fediverse posts

This is the part of 2FA/TOTP that many people don’t realize:

Your phone isn’t receiving the 6-digit code from the server.

Instead, your authenticator app acts like a specialized cryptographic calculator. 🧮🔐

It takes a shared secret key, combines it with the current time, and applies the TOTP algorithm to generate a temporary 6-digit code.

At the same time, the server independently performs the same calculation using its copy of the secret key and the same time counter.

Same secret + same time counter + same algorithm = same result.

That’s why your authenticator app can generate the correct code without receiving it from the server.

It’s a simple idea, but a brilliant application of cryptography.

You can even test this yourself: add the same TOTP secret to both Google Authenticator and Microsoft Authenticator. Even if you set them up at different times, both apps can independently generate the same 6-digit code at the same time.

And here’s another important point:

The algorithm doesn’t need to be secret.

TOTP is based on publicly known, standardized cryptographic algorithms such as HMAC. What needs to remain secret is the shared secret key.

So:

🧮 Algorithm/math: Can be publicly known.
🔑 Secret key: Must remain private. Never share it.
⏱️ Time: Isn’t secret.
🔐 Security: Comes from protecting the secret key, not from hiding the algorithm.

That’s a core principle of modern cryptography: A cryptographic system should remain secure even when the algorithm is publicly known. The secret is the key.

#2FA #TwoFactor #Security #Cybersecurity #SecretKey #Authentication #Cryptography #Math #TOTP #OTP #AuthenticatorApp #Internet #SecurityResearch

The New Defcon Badges Pack a Unique Open Source Chip That Doubles as a Security Key

https://fed.brid.gy/r/https://www.wired.com/story/defcon-34-badge-baochip-andrew-bunnie-huang/

ZDNet: Microsoft won’t send you SMS texts for login anymore – why it’s pushing passkeys instead.”On a new support page, Microsoft announced that it will start phasing out SMS as an authentication and account recovery method for personal Microsoft accounts. Instead, the company is pushing passkeys, which offer much stronger security.”

#twofactor #authentication

Amazon. Wants a passkey. Set a passkey.
Go to sign in
Wants email - ok
Wants fingerprint (Macbook Air here) - ok
and now it wants my 2FA

I REALLY do not get why passkeys are ‘the thing’.

#passkey #security #twofactor #2FA

MakeUseOf: This free app turns any USB into a PC security key. “Personally, I prefer using a YubiKey security key to secure my login accounts. However, if you don’t want to splurge on a dedicated hardware key, you can turn your humble USB flash drive into a security key using USB Raptor.”

https://rbfirehose.com/2025/10/19/makeuseof-this-free-app-turns-any-usb-into-a-pc-security-key/

Sandia Lab: Two-factor authentication just got easier. “Researchers at Sandia have announced a more efficient way to generate and send temporary security codes. Unlike conventional methods, the new technique does not depend on the time, which could help secure small and remote network-connected devices, including drones, remote sensors, agricultural equipment and industrial control systems.”

https://rbfirehose.com/2025/07/29/sandia-lab-two-factor-authentication-just-got-easier/

Maybe it's female of me to realise that you can't always control whether you have any devices (let alone USB keys) on your person, or indeed what your face looks. #twoFactor is OK for sophisticated matters of business, but it can't be mandatory for essentials eg proving nationality, accessing email.

I have ALWAYS thought #twoFactor created personal vulnerabilities, particularly but not exclusively when travelling abroad. I (stupidly) hadn't thought about how it facilitates autocratic policies such as ethnic cleansing. #technologyEthics #cybersecurity #civilliberties bsky.app/profile/j2br...

RE: https://bsky.app/profile/did:plc:ic4mplmy2blzwvurli4htcim/post/3ltxpce2dczw2

"His mobile phone, which is required for the two-step authentication process to verify his identity cards, is held by police."

I have ALWAYS thought #twoFactor created personal vulnerabilities, particularly but not exclusively when travelling abroad. I (stupidly) hadn't thought about how it facilitates autocratic policies such as ethnic cleansing. Much like #AISurveillance.

#giftArticle in previous toot.

#technologyEthics #cybersecurity #civilliberties

I live in a country where the main federal government service sends account confirmation codes by postal mail. Maybe someone Francophone misheard "two factor" authentication and thought it was «du facteur» authentication?

#Canada #GCKey #CanadaPost #TwoFactor

Ich wollte mich heute im Google Browser am Laptop anmelden und sollte die 2 Faktor Authentfizierung im Auto bestätigen (Android Automotive mit Google Chrome) :D #androidautomotive #twofactor #it

I believe it's time to modify Laravel's Authentication flow for a two-step scenario.

It's very difficult to make 2FA unless you deal with a middleware that checks 2FA on EVERY REQUEST, instead of just at the login flow.

#PHP #Laravel #Authentication #Security #2FA #TwoFactorAuthentication #TwoFactor #Auth #Programming #SoftwareDevelopment #WebDevelopment #WebDev

Have you ADDED 2FA to your website? Have you added 2FA to your hosting providers? Have you added 2FA to your keyvault in Azure?

I have.

Maybe you should even if you aren't an enterprise. #2fa #twofactor #cybersecurity

The #Security illusion: Why #TwoFactor #Authentication is No Longer Enough
https://mawgoud.medium.com/the-security-illusion-why-two-factor-authentication-is-no-longer-enough-5985f50d78d5

If I want to migrate away from #Authy, which iOS App would I use these days?

I only need an iOS app. It should sync via iCloud without the need for other external accounts or servers. If I could export the data for the case I want to migrate again, that would be perfect.

No Chrome plugin, no desktop app. Nothing that saves my passwords together with ny #2FA codes. That would be absurd.

Is 2FAS okay? It seems like it's pretty much the best choice currently.

#TwoFactor #Security #iOS #AskFedi

WordPress > Secure your account on wp.org

Here is a good post about how to secure your account on wp.org with an additional security factor:

Setup Two-Factor authentication on wordPress.org
https://make.wordpress.org/meta/2023/09/26/set-up-two-factor-authentication-wordpress-org/

Just generated a passkey, set up a two-facor app and saved some backup codes. Only takes a few minutes and gives piece of mind.

(Especially recommended for theme and plugin authors 😉)

#WordPress #Login #Security #TFA #TwoFactor

Me arrepiento de usar Authy de Twilio para gestionar la autenticación de doble factor. No solo porque ya no dan soporte en Linux, sino que además no te da la opción de exportar las claves para irte a otro software.
Al final lo he conseguido usando un script creado por un héroe sin capa.
Lección que estaréis cansados de escuchar: no usar software libre sale caro.
#TwoFactor #twilio

Ревизия аккаунтов потихоньку доходит до аккаунтов, которыми я не пользовался уже много лет. Смотрю, как сайты изменились.

#DeviantArt позволяет "деактивировать" аккаунт. На странице показывает плачущего робота ( :blobcatwut: ) и подробно перечисляет последствия "деактивации".

Задумался.
Гуляя по аккаунту, набрёл на вкладку Authentication, где встретил прямо-таки золото: двухфакторный вход доступен только по платной подписке. :blobcatheadache:

Я бы понял, если бы они отправляли SMS; но описание прямо там же утверждает, что код надо будет вводить из генератора — т. е. там банальный #TOTP, кроме разовых расходов на разработку эта фича ничего не расходует. :blobcatbolb:

Ну ладно. (Отключил аккаунт.)

#security #2fa #TwoFactor

Why does #Sharkey / #Misskey need an "authenticator app" registered before you can use a hardware key? That doesn't make sense #security wise.

Yeah I know it's to prevent people from just accidentally getting locked out of their accounts, but there should be an option for #FediAdmins to allow this risk. 🤔

#2FA #yubikey #hardwarekey #cybersecurity #twofactor #twofactorauth #twofactorauthentication

As so many people gather with families and friends, make a plan for yourself to set everyone up with real Two-Factor Authentication, at least on their primary email

Give the gift of resilience

https://ssd.eff.org/module/how-enable-two-factor-authentication

#2FA #TwoFactor #infosec

Is there a good reason #Mastodon doesn't use #2FA in order to log in? #twofactor #security

https://www.schneier.com/blog/archives/2005/02/the_curse_of_th.html

This was written nearly 20 years ago… yet today… I see examples of this "wish it were two factor" all over the place.

One being the leave booking system my workplace now uses (Oracle NetSuite).

You want to do two-factor, fine, let's do it *properly*. FIDO2 WebAuthN.

Want to pretend? Don't bother! (And people why I want to leave the IT sector?)

#InfoSec #TwoFactor #rant

Barn door slamming....#GitHub will start requiring active developers to enable #TwoFactor #authentication #2F on their accounts beginning next week, on March 13. Once expanded to the company's entire user base, the 2FA enrollment requirement will help #secure the accounts of more than 100 million users. https://www.bleepingcomputer.com/news/security/github-makes-2fa-mandatory-next-week-for-active-developers/

I can now use a Yubi Key to lock my iPhone down even more

Apple announces physical Security Key support for Apple ID two-factor, new iMessage verification technology https://9to5mac.com/2022/12/07/apple-security-key-apple-id-imessage-verification/

#Apple #SecurityKey #AppleID #TwoFactor #iMessages