Wala pa ang pahinang ito sa inyong wika. Binabasa ninyo ang tekstong Ingles.
Glossary
Two-factor authentication
Two-factor authentication is a sign-in that asks for a second proof, so a password on its own opens nothing.
How the second step runs
The password no longer ends the sign-in. It ends the first half of it.
- 1
The password is checked
What comes back is not a pass but a short-lived ticket to the second half, signed with a key of its own so it can never be mistaken for a pass.
- 2
The number is checked
The app on the phone and the server count the same steps from a shared clock and arrive at the same six digits without ever talking to each other.
- 3
The pass is issued
Only the second half produces the token that opens the account, and wrong numbers are counted the same way wrong passwords are.
One number and one use
A step lasts thirty seconds, and the step that was just used is remembered, so a number read over somebody's shoulder is already spent.
One neighbouring step is accepted in each direction, which forgives a phone clock that drifted and does not stretch one number over minutes.
Codes for a lost phone
Turning the second step on hands back a set of one-time recovery codes, and the account screen shows how many are left.
Each code works once. Without them a broken phone is a lost account, and that is a support case nobody can close.
The same arithmetic inside a profile
The accounts you work on have their own second step, and reaching for a phone at every sign-in is the slowest part of the day.
A profile can hold that key and show the current number in the same window, so the code and the login form are never on two devices.
Your clock right now
These values are read in your browser on this page and go nowhere. The zone does not enter the arithmetic at all, and only the accuracy of the clock does.
Ang inyong makina, ngayon mismo
- Time zone
- sinusukat sa inyong makina
- Offset in hours
- sinusukat sa inyong makina
Binasa sa inyong browser at ipinapakita rito. Walang ipinapadala kahit saan.
Often confused with
A code by text message
A message can be redirected to a new card at the mobile shop. A number counted on your own device has nothing to intercept.
A program key
A key is a separate door that answers without any second step, which is why a leaked key is revoked rather than waited out.
Access rights
The second step proves who arrived. What that person may then change is the separate question of rank.
What this does not do
- It does not switch anything on elsewhere. The second step here stands in front of the ARMANOS account, and every site you work on has its own to turn on.
- It cannot be made compulsory for a team. Each person turns it on for themselves, and the owner has no setting that requires it of everybody.
- It does not cover a program key. A key signs in on its own terms, so the way to close that door is to revoke the key.
- It does not rescue a key stored inside a profile. That one stays on your machine, never reaches the server, and nothing can rebuild it from the numbers it produced.
Check it
The arithmetic and its edges are files you can open.
- Numbers match the published RFC 6238 vectors, and a used step is turned down
- apps/server/src/auth/2fa/totp.ts · apps/server/test/two-factor.js
- The ticket between halves is signed with its own key and the secret is sealed
- apps/server/src/auth/2fa/two-factor.service.ts
- The profile key produces the same numbers on this machine, past the point a 32 bit counter would fail
- apps/desktop/src/lib/totp.js · apps/desktop/test/totp.js
- Switching the second step on and off leaves a row in the record
- apps/server/src/common/audit/audit.service.ts
Questions
- What if the phone is lost?
- Use a recovery code from the set handed to you when the step was switched on. Each one works once and the remaining count is shown on the account screen.
- Does a wrong clock break it?
- One step either way is forgiven. Beyond that the numbers stop matching, and the fix is to let the device set its time from the network.
- Can somebody reuse a number they saw?
- No. The step that was used is written down, so the same number is turned down for the rest of its own thirty seconds.
- Which authenticator app works?
- Any of them. The link is the ordinary otpauth one and the arithmetic is RFC 6238, so the common apps produce the same number.
- Where does the secret live?
- The account secret is sealed in the database and is never shown again after setup. A key kept inside a profile lives on your own machine.
Put the code where the form is
A profile can hold the key of the account it signs into and show the current number in the same window.