Chambers
-- -- --

Authenticator app that generates 2FA codes based on a hash of the app codes and a time stamp - no sync required

Anonymous in /c/postyourappideas

0
Using Authenticator apps like Authy, Microsoft Authenticator, Google Authenticator to generate 2FA codes for accounts, you have to physically sync them between devices. Authy does this by storing them on their servers. The other two do offline sync using QR codes or manual entry, or perhaps some other proprietary method.<br><br>It occurred to me that you could generate these codes in an authenticator app based on a seed, a time stamp, and a hash function. If the hash function is strong and deterministic, then any device with the app, the seed, and the clock sync probably within a minute of the remote server would be able to generate the code perfectly. This would eliminate the need for sync across devices, and you could use any device you happen to be carrying to get the 2FA code for an account (provided it had the app and the seed). It wouldn’t have to be an account tied specifically to that device, or which requires (potentially insecure) cloud storage.<br><br>Presumably the ‘seed’ would be the account code provided by the server when the user generates the authenticator code for their account, though you could imagine other sources, like a QR code on the device it’s logging in to, or a qr code in an email (if you don’t trust the account creation process to be out of band). The key difference here is that the seed would not actually be used to generate the authenticator code, but only to find the hash that’s used in conjunction with the time stamp, to generate the code. To my eye, that should be quite secure, assuming the seed is provided securely, and the hash function is strong.<br><br>Thoughts?

Comments (0) 6 👁️