
These days I am using a number of services on a regular basis that require a 2nd factor authentication in addition to a password. Two of them send me a 6 digit time-based one time password (TOTP) over SMS each time I want to log-in. The other two send the 6 digit code by email. While that works quite well in general, there are two problems with this: First, SMS is sometimes a bit laggy and said not to be secure enough. And second, using email as a second factor for authentication makes me dependent on a particular provider if I don’t own the domain name. Not ideal. So when I recently had a closer look at the TOTP mechanism, I noticed that it is a standardized procedure and there are open source authenticator apps available that work with pretty much all services that offer TOTP passwords with an authenticator.
This is a game changer for me, as I was shying away from TOTP apps so far, as I didn’t want to install a multitude of authentication apps. Also, a proprietary app that syncs key material with a hyperscaler was obviously out of the question as well. Having an open source implementation that is totally local and under my control, however, changes the story. And even better, I already had an app installed on my Android device that could do the job for all websites I’m using: KeePassDX.
Continue reading TOTP Authentication – Open Source and Between Devices

