The above code has the contents: otpauth://totp/TOTP00017410?secret=O6LVCAVTS2IJ25NKXKOOGCNTJIOFNUXA&counter=1&digits=6&issuer=privacyIDEA The QRCode contains the seed in clear text. With the Google Authenticator this happens with a QRCode. The initialization of the smartphone app. The Seed (2)īut the even much simpler misuse is during the enrollment process.

The smartphone is a powerful computer with old, not up-to-date software and usually a bad virus protection. We doubt that you can protect the seed in the smartphone on a high security level. This means that the seed needs to be protected.

Using the algorithm, the seed and a moving factor the OTP value is calculated. The OTP algorithms HOTP and TOTP are based on a symmetric secret key which is also called seed. An important aspect of the factor “possession” is, that the user takes care of this factor and does not leave it on the desk or plugged into the computer when going for lunch or leaving the room otherwise. Using your smartphone as an authentication device can indeed make sense. Possible other apps are FreeOTP (TOTP) or HDE OTP (TOTP). The Google Authenitcator supports HOTP and TOTP algorithms.

The Google Authenticator was one of the first apps, that provided the OTP functionality with a piece of software on your smartphone. In certain cases the so called two factor authentication again boils down to one factor. I very much like that everybody is thinking about increasing their security, but when talking of smartphone apps, email or SMS, we also have to be aware of the limits, that come with these convenient solutions. But now two factor authentication is handy and cost efficient.Īnd finally we all learned that we should do something about our data security. A few years ago two factor authentication was a topic for large companies and those with a high need for security. A good mobile network coverage, cheap smartphones and the trend “bring your own device” led to a paradigm shift in two factor authentication.

Google authenticator totp or hotp