Show HN: Minimal TOTP generator in 20 lines of Python

Re:Show HN: Minimal TOTP generator in 20 lines of Python by anandsubra on Saturday October 19, 2019 @06:42AM (#21297799)

> Many websites and services require two-factor authentication (2FA) or multi-factor authentication (MFA) where the user is required to present two or more pieces of evidence: • Something only the user knows, e.g., password, passphrase, etc. • Something only the user has, e.g., hardware token, mobile phone, etc. • Something only the user is, e.g., biometrics.

Apart from mobile phones using fingerprints to unlock, are biometrics used in any mainstream MFA? Are there any websites, services or companies that accept passwords and OTPs also accept biometrics for authentication?

[ Parent | on HN ]

Re:Show HN: Minimal TOTP generator in 20 lines of Python by jankiehodgpodge on Sunday October 20, 2019 @05:36AM (#21303123)

No and I'm not sure this would be desirable either, it would mean having to have services store and validate your biometric data.

[ Parent | on HN ]

Re:Show HN: Minimal TOTP generator in 20 lines of Python by blamestross on Sunday October 20, 2019 @09:12AM (#21303897)

And transmit it! Biometrics are useless for remote 2fa. They only even make a little sense when used for immediate local hardware interaction. From a remote perspective you can't authenticate biometrics versus a replay attack. Hardware does it by literally being hardware and thus has high confidence it is talking to the real sensor and you will note all the phones require harder authentication on boot before enabling biometric authentication.

[ Parent | on HN ]