#twofactor — Public Fediverse posts

This is the part of 2FA/TOTP that many people don’t realize:

Your phone isn’t receiving the 6-digit code from the server.

Instead, your authenticator app acts like a specialized cryptographic calculator. 🧮🔐

It takes a shared secret key, combines it with the current time, and applies the TOTP algorithm to generate a temporary 6-digit code.

At the same time, the server independently performs the same calculation using its copy of the secret key and the same time counter.

Same secret + same time counter + same algorithm = same result.

That’s why your authenticator app can generate the correct code without receiving it from the server.

It’s a simple idea, but a brilliant application of cryptography.

You can even test this yourself: add the same TOTP secret to both Google Authenticator and Microsoft Authenticator. Even if you set them up at different times, both apps can independently generate the same 6-digit code at the same time.

And here’s another important point:

The algorithm doesn’t need to be secret.

TOTP is based on publicly known, standardized cryptographic algorithms such as HMAC. What needs to remain secret is the shared secret key.

So:

🧮 Algorithm/math: Can be publicly known.
🔑 Secret key: Must remain private. Never share it.
⏱️ Time: Isn’t secret.
🔐 Security: Comes from protecting the secret key, not from hiding the algorithm.

That’s a core principle of modern cryptography: A cryptographic system should remain secure even when the algorithm is publicly known. The secret is the key.

#2FA #TwoFactor #Security #Cybersecurity #SecretKey #Authentication #Cryptography #Math #TOTP #OTP #AuthenticatorApp #Internet #SecurityResearch

This is the part of 2FA/TOTP that many people don’t realize:

Your phone isn’t receiving the 6-digit code from the server.

Instead, your authenticator app acts like a specialized cryptographic calculator. 🧮🔐

It takes a shared secret key, combines it with the current time, and applies the TOTP algorithm to generate a temporary 6-digit code.

At the same time, the server independently performs the same calculation using its copy of the secret key and the same time counter.

Same secret + same time counter + same algorithm = same result.

That’s why your authenticator app can generate the correct code without receiving it from the server.

It’s a simple idea, but a brilliant application of cryptography.

You can even test this yourself: add the same TOTP secret to both Google Authenticator and Microsoft Authenticator. Even if you set them up at different times, both apps can independently generate the same 6-digit code at the same time.

And here’s another important point:

The algorithm doesn’t need to be secret.

TOTP is based on publicly known, standardized cryptographic algorithms such as HMAC. What needs to remain secret is the shared secret key.

So:

🧮 Algorithm/math: Can be publicly known.
🔑 Secret key: Must remain private. Never share it.
⏱️ Time: Isn’t secret.
🔐 Security: Comes from protecting the secret key, not from hiding the algorithm.

That’s a core principle of modern cryptography: A cryptographic system should remain secure even when the algorithm is publicly known. The secret is the key.

#2FA #TwoFactor #Security #Cybersecurity #SecretKey #Authentication #Cryptography #Math #TOTP #OTP #AuthenticatorApp #Internet #SecurityResearch

This is the part of 2FA/TOTP that many people don’t realize:

Your phone isn’t receiving the 6-digit code from the server.

Instead, your authenticator app acts like a specialized cryptographic calculator. 🧮🔐

It takes a shared secret key, combines it with the current time, and applies the TOTP algorithm to generate a temporary 6-digit code.

At the same time, the server independently performs the same calculation using its copy of the secret key and the same time counter.

Same secret + same time counter + same algorithm = same result.

That’s why your authenticator app can generate the correct code without receiving it from the server.

It’s a simple idea, but a brilliant application of cryptography.

You can even test this yourself: add the same TOTP secret to both Google Authenticator and Microsoft Authenticator. Even if you set them up at different times, both apps can independently generate the same 6-digit code at the same time.

And here’s another important point:

The algorithm doesn’t need to be secret.

TOTP is based on publicly known, standardized cryptographic algorithms such as HMAC. What needs to remain secret is the shared secret key.

So:

🧮 Algorithm/math: Can be publicly known.
🔑 Secret key: Must remain private. Never share it.
⏱️ Time: Isn’t secret.
🔐 Security: Comes from protecting the secret key, not from hiding the algorithm.

That’s a core principle of modern cryptography: A cryptographic system should remain secure even when the algorithm is publicly known. The secret is the key.

#2FA #TwoFactor #Security #Cybersecurity #SecretKey #Authentication #Cryptography #Math #TOTP #OTP #AuthenticatorApp #Internet #SecurityResearch

This is the part of 2FA/TOTP that many people don’t realize:

Your phone isn’t receiving the 6-digit code from the server.

Instead, your authenticator app acts like a specialized cryptographic calculator. 🧮🔐

It takes a shared secret key, combines it with the current time, and applies the TOTP algorithm to generate a temporary 6-digit code.

At the same time, the server independently performs the same calculation using its copy of the secret key and the same time counter.

Same secret + same time counter + same algorithm = same result.

That’s why your authenticator app can generate the correct code without receiving it from the server.

It’s a simple idea, but a brilliant application of cryptography.

You can even test this yourself: add the same TOTP secret to both Google Authenticator and Microsoft Authenticator. Even if you set them up at different times, both apps can independently generate the same 6-digit code at the same time.

And here’s another important point:

The algorithm doesn’t need to be secret.

TOTP is based on publicly known, standardized cryptographic algorithms such as HMAC. What needs to remain secret is the shared secret key.

So:

🧮 Algorithm/math: Can be publicly known.
🔑 Secret key: Must remain private. Never share it.
⏱️ Time: Isn’t secret.
🔐 Security: Comes from protecting the secret key, not from hiding the algorithm.

That’s a core principle of modern cryptography: A cryptographic system should remain secure even when the algorithm is publicly known. The secret is the key.

#2FA #TwoFactor #Security #Cybersecurity #SecretKey #Authentication #Cryptography #Math #TOTP #OTP #AuthenticatorApp #Internet #SecurityResearch

This is the part of 2FA/TOTP that many people don’t realize:

Your phone isn’t receiving the 6-digit code from the server.

Instead, your authenticator app acts like a specialized cryptographic calculator. 🧮🔐

It takes a shared secret key, combines it with the current time, and applies the TOTP algorithm to generate a temporary 6-digit code.

At the same time, the server independently performs the same calculation using its copy of the secret key and the same time counter.

Same secret + same time counter + same algorithm = same result.

That’s why your authenticator app can generate the correct code without receiving it from the server.

It’s a simple idea, but a brilliant application of cryptography.

You can even test this yourself: add the same TOTP secret to both Google Authenticator and Microsoft Authenticator. Even if you set them up at different times, both apps can independently generate the same 6-digit code at the same time.

And here’s another important point:

The algorithm doesn’t need to be secret.

TOTP is based on publicly known, standardized cryptographic algorithms such as HMAC. What needs to remain secret is the shared secret key.

So:

🧮 Algorithm/math: Can be publicly known.
🔑 Secret key: Must remain private. Never share it.
⏱️ Time: Isn’t secret.
🔐 Security: Comes from protecting the secret key, not from hiding the algorithm.

That’s a core principle of modern cryptography: A cryptographic system should remain secure even when the algorithm is publicly known. The secret is the key.

#2FA #TwoFactor #Security #Cybersecurity #SecretKey #Authentication #Cryptography #Math #TOTP #OTP #AuthenticatorApp #Internet #SecurityResearch

The New Defcon Badges Pack a Unique Open Source Chip That Doubles as a Security Key

https://fed.brid.gy/r/https://www.wired.com/story/defcon-34-badge-baochip-andrew-bunnie-huang/

The New Defcon Badges Pack a Unique Open Source Chip That Doubles as a Security Key

https://fed.brid.gy/r/https://www.wired.com/story/defcon-34-badge-baochip-andrew-bunnie-huang/

The New Defcon Badges Pack a Unique Open Source Chip That Doubles as a Security Key

https://fed.brid.gy/r/https://www.wired.com/story/defcon-34-badge-baochip-andrew-bunnie-huang/

The New Defcon Badges Pack a Unique Open Source Chip That Doubles as a Security Key

https://fed.brid.gy/r/https://www.wired.com/story/defcon-34-badge-baochip-andrew-bunnie-huang/

The New Defcon Badges Pack a Unique Open Source Chip That Doubles as a Security Key

https://fed.brid.gy/r/https://www.wired.com/story/defcon-34-badge-baochip-andrew-bunnie-huang/

ZDNet: Microsoft won’t send you SMS texts for login anymore – why it’s pushing passkeys instead.”On a new support page, Microsoft announced that it will start phasing out SMS as an authentication and account recovery method for personal Microsoft accounts. Instead, the company is pushing passkeys, which offer much stronger security.”

ZDNet: Microsoft won’t send you SMS texts for login anymore – why it’s pushing passkeys instead.”On a new support page, Microsoft announced that it will start phasing out SMS as an authentication and account recovery method for personal Microsoft accounts. Instead, the company is pushing passkeys, which offer much stronger security.”

ZDNet: Microsoft won’t send you SMS texts for login anymore – why it’s pushing passkeys instead.”On a new support page, Microsoft announced that it will start phasing out SMS as an authentication and account recovery method for personal Microsoft accounts. Instead, the company is pushing passkeys, which offer much stronger security.”

ZDNet: Microsoft won’t send you SMS texts for login anymore – why it’s pushing passkeys instead.”On a new support page, Microsoft announced that it will start phasing out SMS as an authentication and account recovery method for personal Microsoft accounts. Instead, the company is pushing passkeys, which offer much stronger security.”

ZDNet: Microsoft won’t send you SMS texts for login anymore – why it’s pushing passkeys instead.”On a new support page, Microsoft announced that it will start phasing out SMS as an authentication and account recovery method for personal Microsoft accounts. Instead, the company is pushing passkeys, which offer much stronger security.”

#twofactor #authentication

#twofactor #authentication

#twofactor #authentication

#twofactor #authentication

#twofactor #authentication

Amazon. Wants a passkey. Set a passkey.
Go to sign in
Wants email - ok
Wants fingerprint (Macbook Air here) - ok
and now it wants my 2FA

I REALLY do not get why passkeys are ‘the thing’.

#passkey #security #twofactor #2FA

Amazon. Wants a passkey. Set a passkey.
Go to sign in
Wants email - ok
Wants fingerprint (Macbook Air here) - ok
and now it wants my 2FA

I REALLY do not get why passkeys are ‘the thing’.

#passkey #security #twofactor #2FA

MakeUseOf: This free app turns any USB into a PC security key. “Personally, I prefer using a YubiKey security key to secure my login accounts. However, if you don’t want to splurge on a dedicated hardware key, you can turn your humble USB flash drive into a security key using USB Raptor.”

https://rbfirehose.com/2025/10/19/makeuseof-this-free-app-turns-any-usb-into-a-pc-security-key/

MakeUseOf: This free app turns any USB into a PC security key. “Personally, I prefer using a YubiKey security key to secure my login accounts. However, if you don’t want to splurge on a dedicated hardware key, you can turn your humble USB flash drive into a security key using USB Raptor.”

https://rbfirehose.com/2025/10/19/makeuseof-this-free-app-turns-any-usb-into-a-pc-security-key/

MakeUseOf: This free app turns any USB into a PC security key. “Personally, I prefer using a YubiKey security key to secure my login accounts. However, if you don’t want to splurge on a dedicated hardware key, you can turn your humble USB flash drive into a security key using USB Raptor.”

https://rbfirehose.com/2025/10/19/makeuseof-this-free-app-turns-any-usb-into-a-pc-security-key/

MakeUseOf: This free app turns any USB into a PC security key. “Personally, I prefer using a YubiKey security key to secure my login accounts. However, if you don’t want to splurge on a dedicated hardware key, you can turn your humble USB flash drive into a security key using USB Raptor.”

https://rbfirehose.com/2025/10/19/makeuseof-this-free-app-turns-any-usb-into-a-pc-security-key/

Sandia Lab: Two-factor authentication just got easier. “Researchers at Sandia have announced a more efficient way to generate and send temporary security codes. Unlike conventional methods, the new technique does not depend on the time, which could help secure small and remote network-connected devices, including drones, remote sensors, agricultural equipment and industrial control systems.”

https://rbfirehose.com/2025/07/29/sandia-lab-two-factor-authentication-just-got-easier/

Sandia Lab: Two-factor authentication just got easier. “Researchers at Sandia have announced a more efficient way to generate and send temporary security codes. Unlike conventional methods, the new technique does not depend on the time, which could help secure small and remote network-connected devices, including drones, remote sensors, agricultural equipment and industrial control systems.”

https://rbfirehose.com/2025/07/29/sandia-lab-two-factor-authentication-just-got-easier/

Sandia Lab: Two-factor authentication just got easier. “Researchers at Sandia have announced a more efficient way to generate and send temporary security codes. Unlike conventional methods, the new technique does not depend on the time, which could help secure small and remote network-connected devices, including drones, remote sensors, agricultural equipment and industrial control systems.”

https://rbfirehose.com/2025/07/29/sandia-lab-two-factor-authentication-just-got-easier/

Maybe it's female of me to realise that you can't always control whether you have any devices (let alone USB keys) on your person, or indeed what your face looks. #twoFactor is OK for sophisticated matters of business, but it can't be mandatory for essentials eg proving nationality, accessing email.

Maybe it's female of me to realise that you can't always control whether you have any devices (let alone USB keys) on your person, or indeed what your face looks. #twoFactor is OK for sophisticated matters of business, but it can't be mandatory for essentials eg proving nationality, accessing email.

I have ALWAYS thought #twoFactor created personal vulnerabilities, particularly but not exclusively when travelling abroad. I (stupidly) hadn't thought about how it facilitates autocratic policies such as ethnic cleansing. #technologyEthics #cybersecurity #civilliberties bsky.app/profile/j2br...

RE: https://bsky.app/profile/did:plc:ic4mplmy2blzwvurli4htcim/post/3ltxpce2dczw2

I have ALWAYS thought #twoFactor created personal vulnerabilities, particularly but not exclusively when travelling abroad. I (stupidly) hadn't thought about how it facilitates autocratic policies such as ethnic cleansing. #technologyEthics #cybersecurity #civilliberties bsky.app/profile/j2br...

RE: https://bsky.app/profile/did:plc:ic4mplmy2blzwvurli4htcim/post/3ltxpce2dczw2

I have ALWAYS thought #twoFactor created personal vulnerabilities, particularly but not exclusively when travelling abroad. I (stupidly) hadn't thought about how it facilitates autocratic policies such as ethnic cleansing. #technologyEthics #cybersecurity #civilliberties bsky.app/profile/j2br...

RE: https://bsky.app/profile/did:plc:ic4mplmy2blzwvurli4htcim/post/3ltxpce2dczw2

I have ALWAYS thought #twoFactor created personal vulnerabilities, particularly but not exclusively when travelling abroad. I (stupidly) hadn't thought about how it facilitates autocratic policies such as ethnic cleansing. #technologyEthics #cybersecurity #civilliberties bsky.app/profile/j2br...

RE: https://bsky.app/profile/did:plc:ic4mplmy2blzwvurli4htcim/post/3ltxpce2dczw2

I have ALWAYS thought #twoFactor created personal vulnerabilities, particularly but not exclusively when travelling abroad. I (stupidly) hadn't thought about how it facilitates autocratic policies such as ethnic cleansing. Much like #AISurveillance. #technologyEthics #cybersecurity #civilliberties

RE: https://bsky.app/profile/did:plc:ic4mplmy2blzwvurli4htcim/post/3ltxpce2dczw2

Joanna Bryson, blathering (@j2...

I have ALWAYS thought #twoFactor created personal vulnerabilities, particularly but not exclusively when travelling abroad. I (stupidly) hadn't thought about how it facilitates autocratic policies such as ethnic cleansing. Much like #AISurveillance. #technologyEthics #cybersecurity #civilliberties

RE: https://bsky.app/profile/did:plc:ic4mplmy2blzwvurli4htcim/post/3ltxpce2dczw2

Joanna Bryson, blathering (@j2...

I have ALWAYS thought #twoFactor created personal vulnerabilities, particularly but not exclusively when travelling abroad. I (stupidly) hadn't thought about how it facilitates autocratic policies such as ethnic cleansing. Much like #AISurveillance. #technologyEthics #cybersecurity #civilliberties

RE: https://bsky.app/profile/did:plc:ic4mplmy2blzwvurli4htcim/post/3ltxpce2dczw2

Joanna Bryson, blathering (@j2...

"His mobile phone, which is required for the two-step authentication process to verify his identity cards, is held by police."

I have ALWAYS thought #twoFactor created personal vulnerabilities, particularly but not exclusively when travelling abroad. I (stupidly) hadn't thought about how it facilitates autocratic policies such as ethnic cleansing. Much like #AISurveillance.

#giftArticle in previous toot.

#technologyEthics #cybersecurity #civilliberties

"His mobile phone, which is required for the two-step authentication process to verify his identity cards, is held by police."

I have ALWAYS thought #twoFactor created personal vulnerabilities, particularly but not exclusively when travelling abroad. I (stupidly) hadn't thought about how it facilitates autocratic policies such as ethnic cleansing. Much like #AISurveillance.

#giftArticle in previous toot.

#technologyEthics #cybersecurity #civilliberties

"His mobile phone, which is required for the two-step authentication process to verify his identity cards, is held by police."

I have ALWAYS thought #twoFactor created personal vulnerabilities, particularly but not exclusively when travelling abroad. I (stupidly) hadn't thought about how it facilitates autocratic policies such as ethnic cleansing. Much like #AISurveillance.

#giftArticle in previous toot.

#technologyEthics #cybersecurity #civilliberties

"His mobile phone, which is required for the two-step authentication process to verify his identity cards, is held by police."

I have ALWAYS thought #twoFactor created personal vulnerabilities, particularly but not exclusively when travelling abroad. I (stupidly) hadn't thought about how it facilitates autocratic policies such as ethnic cleansing. Much like #AISurveillance.

#giftArticle in previous toot.

#technologyEthics #cybersecurity #civilliberties

"His mobile phone, which is required for the two-step authentication process to verify his identity cards, is held by police."

I have ALWAYS thought #twoFactor created personal vulnerabilities, particularly but not exclusively when travelling abroad. I (stupidly) hadn't thought about how it facilitates autocratic policies such as ethnic cleansing. Much like #AISurveillance.

#giftArticle in previous toot.

#technologyEthics #cybersecurity #civilliberties

I live in a country where the main federal government service sends account confirmation codes by postal mail. Maybe someone Francophone misheard "two factor" authentication and thought it was «du facteur» authentication?

#Canada #GCKey #CanadaPost #TwoFactor

I live in a country where the main federal government service sends account confirmation codes by postal mail. Maybe someone Francophone misheard "two factor" authentication and thought it was «du facteur» authentication?

#Canada #GCKey #CanadaPost #TwoFactor

I live in a country where the main federal government service sends account confirmation codes by postal mail. Maybe someone Francophone misheard "two factor" authentication and thought it was «du facteur» authentication?

#Canada #GCKey #CanadaPost #TwoFactor

I live in a country where the main federal government service sends account confirmation codes by postal mail. Maybe someone Francophone misheard "two factor" authentication and thought it was «du facteur» authentication?

#Canada #GCKey #CanadaPost #TwoFactor

I live in a country where the main federal government service sends account confirmation codes by postal mail. Maybe someone Francophone misheard "two factor" authentication and thought it was «du facteur» authentication?

#Canada #GCKey #CanadaPost #TwoFactor

Ich wollte mich heute im Google Browser am Laptop anmelden und sollte die 2 Faktor Authentfizierung im Auto bestätigen (Android Automotive mit Google Chrome) :D #androidautomotive #twofactor #it

I believe it's time to modify Laravel's Authentication flow for a two-step scenario.

It's very difficult to make 2FA unless you deal with a middleware that checks 2FA on EVERY REQUEST, instead of just at the login flow.

#PHP #Laravel #Authentication #Security #2FA #TwoFactorAuthentication #TwoFactor #Auth #Programming #SoftwareDevelopment #WebDevelopment #WebDev

I believe it's time to modify Laravel's Authentication flow for a two-step scenario.

It's very difficult to make 2FA unless you deal with a middleware that checks 2FA on EVERY REQUEST, instead of just at the login flow.

#PHP #Laravel #Authentication #Security #2FA #TwoFactorAuthentication #TwoFactor #Auth #Programming #SoftwareDevelopment #WebDevelopment #WebDev

I believe it's time to modify Laravel's Authentication flow for a two-step scenario.

It's very difficult to make 2FA unless you deal with a middleware that checks 2FA on EVERY REQUEST, instead of just at the login flow.

#PHP #Laravel #Authentication #Security #2FA #TwoFactorAuthentication #TwoFactor #Auth #Programming #SoftwareDevelopment #WebDevelopment #WebDev

I believe it's time to modify Laravel's Authentication flow for a two-step scenario.

It's very difficult to make 2FA unless you deal with a middleware that checks 2FA on EVERY REQUEST, instead of just at the login flow.

#PHP #Laravel #Authentication #Security #2FA #TwoFactorAuthentication #TwoFactor #Auth #Programming #SoftwareDevelopment #WebDevelopment #WebDev

I believe it's time to modify Laravel's Authentication flow for a two-step scenario.

It's very difficult to make 2FA unless you deal with a middleware that checks 2FA on EVERY REQUEST, instead of just at the login flow.

#PHP #Laravel #Authentication #Security #2FA #TwoFactorAuthentication #TwoFactor #Auth #Programming #SoftwareDevelopment #WebDevelopment #WebDev

Have you ADDED 2FA to your website? Have you added 2FA to your hosting providers? Have you added 2FA to your keyvault in Azure?

I have.

Maybe you should even if you aren't an enterprise. #2fa #twofactor #cybersecurity

Have you ADDED 2FA to your website? Have you added 2FA to your hosting providers? Have you added 2FA to your keyvault in Azure?

I have.

Maybe you should even if you aren't an enterprise. #2fa #twofactor #cybersecurity

Have you ADDED 2FA to your website? Have you added 2FA to your hosting providers? Have you added 2FA to your keyvault in Azure?

I have.

Maybe you should even if you aren't an enterprise. #2fa #twofactor #cybersecurity

Have you ADDED 2FA to your website? Have you added 2FA to your hosting providers? Have you added 2FA to your keyvault in Azure?

I have.

Maybe you should even if you aren't an enterprise. #2fa #twofactor #cybersecurity

Have you ADDED 2FA to your website? Have you added 2FA to your hosting providers? Have you added 2FA to your keyvault in Azure?

I have.

Maybe you should even if you aren't an enterprise. #2fa #twofactor #cybersecurity

The #Security illusion: Why #TwoFactor #Authentication is No Longer Enough
https://mawgoud.medium.com/the-security-illusion-why-two-factor-authentication-is-no-longer-enough-5985f50d78d5