Stack Overflow
Stack Overflow

Questions tagged [totp]

Time-based One-Time Password algorithm (TOTP) is an algorithm that computes a one-time password from a shared secret key and the current time.

Time-based One-Time Password algorithm (TOTP) is an algorithm that computes a one-time password from a shared secret key and the current time.

TOTP is based on HOTP with a timestamp replacing the incrementing counter.

The current timestamp is turned into an integer time-counter (TC) by defining the start of an epoch (T0) and counting in units of a time interval (TI).

Wiki: https://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm

172 questions
14
votes
1 answer

Multi-Factor Authentication with Spring Boot 2 and Spring Security 5

I want to add multi-factor authentication with TOTP soft tokens to an Angular & Spring application, while keeping everything as close as possible to the defaults of Spring Boot Security Starter. The token-validation happens locally (with the…
phisch
  • 4,571
  • 2
  • 34
  • 52
10
votes
2 answers

Error trying to set up user MFA Preferences

I'm using the AWS CLI to enable a MFA user pool with only TOTP MFA (no SMS). aws cognito-idp set-user-pool-mfa-config --user-pool-id xxxx_xxxx --mfa-configuration OPTIONAL --software-token-mfa-configuration Enabled=true { …
Luciano Jr
  • 131
  • 1
  • 8
7
votes
3 answers

OTP code generation and validation with otp.net

I'm using the Otp.NET library to generate and validate an OTP. I want to use the TOTP algorithm. The generated OTP needs to be valid for 5 minutes. The library is recommending to use var totp = new Totp(secretKey, step: 300); for this. But the OTP…
Kushan Sameera
  • 169
  • 1
  • 1
  • 9
7
votes
2 answers

Two-factor authentication with Google Authenticator - manually type key instead of scanning QR code

In Google Authenticator app you can either scan a QR code or manually type a key provided by the issuer. In the following screenshot you can see the setup of 2FA among Google Security settings, displaying how to get the TOTP by following the 2nd…
ilPittiz
  • 734
  • 1
  • 10
  • 23
5
votes
1 answer

How to include TOTP MFA in AWS Cognito authentication process

I'm using Cognito user pools to authenticate my web application. I've got it all working right now but now I need to enable MFA for it. This is how I do it right now (all the code provided are server-side code): Signing up the user: const cognito…
Mehran
  • 15,593
  • 27
  • 122
  • 221
4
votes
1 answer

optlib token inconsistent expiry time?

I'm using otplib: https://github.com/yeojz/otplib Each user has its own secret stored in a database. When a user logs in for 2FA I run totp.generate(secret); on the user's secret. I set step to 5 minutes const { totp } =…
user349557
  • 83
  • 1
  • 12
4
votes
2 answers

Reset/Revoke Cognito MFA (Phone Number) through and update it through login

I have gone through all the questions, but all are not matching exactly with my scenario. Scenario: Admin can reset the phone number of any user. After resetting/revoking the phone number, user will get logout (if already login), and then user will…
Muhammad Arqam
  • 119
  • 1
  • 5
  • 13
4
votes
0 answers

QR Code VS OtpAuth Link when setting up an Authenticator App on the phone

Our website can be both opened from a desktop and from a mobile device. When users set up an MFA on a desktop, it makes sense for them to scan the QR code straight from their PC's screen using a mobile phone camera. But when they logged in on a…
andkorsh
  • 685
  • 7
  • 20
4
votes
1 answer

How to use AWS cognito TOTP MFA?

I'm having a hard time figuring out how to use this library: https://github.com/aws-amplify/amplify-js/tree/master/packages/amazon-cognito-identity-js where it says Use case 27. Selecting the MFA method and authenticating using TOTP. I have already…
Johhan Santana
  • 2,336
  • 5
  • 33
  • 61
3
votes
1 answer

problem in run code gives Error: Non-base32 digit found

im facing problem while running code below always give "Error: Non-base32 digit found" i did searched online and fix it by using utf-8 for secret = base64.b32decode(bytes(secret, 'utf-8')) but its not working giving me same error. Any suggestion?…
Jessa
  • 31
  • 1
  • 3
3
votes
1 answer

How to set up Optional MFA with AWS Cognito AmplifyAuthenticator?

If I set a cognito pool to require MFA (TOTP) my implementation on the client side with AmplifyAuthenticator from @aws-amplify/ui-react works just fine automatically. But if I create a cognito pool where MFA is optional, there is no automatic option…
Adam James
  • 3,833
  • 6
  • 28
  • 47
3
votes
1 answer

how to convert a number to base32 in java as per RFC-4648

Actually I'm trying to use TOTP in my app and google authenticator requires the key to be in base32 format. This is the reason I'm trying to convert a key to base32 format Let's say I have a number = 150820200825235. This wikipedia page says that…
Nitin Verma
  • 485
  • 4
  • 19
3
votes
1 answer

How do I generate the correct TOTP with Node with correct Headers and SHA512 hashed Token?

A recent school project I was assigned has a coding challenge we have to complete. The challenge has multiple parts, and the final part is uploading to a private GitHub repo and submitting a completion request by making a POST request under certain…
ThisIsNotAnId
  • 177
  • 4
  • 20
3
votes
0 answers

How to implement TOTP (2FA) correctly in Spring Security?

I am writing a small application for myself and want to implement 2-factor authentication in Spring Boot. To do this, follow the tips of this article: https://www.baeldung.com/spring-security-two-factor-authentication-with-soft-token Faced the…
Chudo v peryax
  • 31
  • 1
  • 2
3
votes
1 answer

How to generate secret key to get TOTP for HMAC SHA512 comply with RFC6238 and RFC4086?

I have to make an HTTP POST request to the URL http://example.com/test which contains the JSON string as a body part, headers "Content-Type:application/json" and "Authorization: Basic userid:password". userid is abc@example.com and password must be…
Arjun
  • 41
  • 2
  • 6
1
2 3
…
11 12