Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t...
by nine_k on Friday August 20, 2021 @04:07PM
(#28250804)
You mean TOTP?
Imagine a hash function that generates a number from the number of minutes since epoch hashed additionally with some seed. You have it on the server, you have it on your, say, phone. When you enroll you share a seed for the generator. Since your time is synchronized, the server knows what value(s) to expect, and the phone knows which value to generate.
Imagine a hash function that generates a number from the number of minutes since epoch hashed additionally with some seed. You have it on the server, you have it on your, say, phone. When you enroll you share a seed for the generator. Since your time is synchronized, the server knows what value(s) to expect, and the phone knows which value to generate.
The real scheme is a bit more involved: https://en.m.wikipedia.org/wiki/Time-based_One-Time_Password...