Source: TH
Context: The rising vulnerability of passwords has led to the adoption of Two-Factor Authentication (2FA) worldwide. Popular apps like Google Authenticator now use TOTP-based codes that refresh every 30 seconds to enhance digital security.
About Two-Factor Authentication (2FA):
- What it is?
- A security mechanism that requires users to verify identity using two different factors — something they know (password) and something they have (phone/authenticator app).
- Developed by:
- Concept of multi-factor authentication emerged in the 1980s in computer science security research.
- TOTP standard (Time-based One-Time Password) was developed by IETF (Internet Engineering Task Force) in 2011 for global interoperability.
- Objective: To strengthen authentication, prevent account breaches, and ensure data security by adding a second verification layer beyond traditional passwords.
- How it works:
-
- Step 1: User enters password (first factor).
- Step 2: An authenticator app or hardware token generates a time-based OTP (second factor).
- The server and app share a secret key, using cryptographic HMAC functions with time counters to generate identical codes.
- If both match, access is granted.
- Features:
-
- Uses TOTP (Time-based One-Time Passwords) valid for ~30 seconds.
- Employs hash functions & HMAC-SHA256 for strong encryption.
- Works offline via authenticator apps (Google Authenticator, Authy, Microsoft Authenticator).
- Can also be implemented via hardware tokens (YubiKey), SMS, or push notifications.
- Layered approach makes brute force or code interception nearly impossible.
- Significance:
-
- Shields accounts from password theft, phishing, and brute-force attacks.
- Widely used in banking, government portals, healthcare, and corporate IT systems.
- Promotes digital trust, crucial for Digital India, Aadhaar-based services, and cyber governance.
