Google Authenticator available as a public service?

by

The project is open source. I have not used it. But it’s using a documented algorithm (noted in the RFC listed on the open source project page), and the authenticator implementations support multiple accounts.

The actual process is straightforward. The one time code is, essentially, a pseudo random number generator. A random number generator is a formula that once given a seed, or starting number, continues to create a stream of random numbers. Given a seed, while the numbers may be random to each other, the sequence itself is deterministic. So, once you have your device and the server “in sync” then the random numbers that the device creates, each time you hit the “next number button”, will be the same, random, numbers the server expects.

A secure one time password system is more sophisticated than a random number generator, but the concept is similar. There are also other details to help keep the device and server in sync.

So, there’s no need for someone else to host the authentication, like, say OAuth. Instead you need to implement that algorithm that is compatible with the apps that Google provides for the mobile devices. That software is (should be) available on the open source project.

Depending on your sophistication, you should have all you need to implement the server side of this process give the OSS project and the RFC. I do not know if there is a specific implementation for your server software (PHP, Java, .NET, etc.)

But, specifically, you don’t need an offsite service to handle this.

More Related Contents:

  1. JWT (JSON Web Token) automatic prolongation of expiration
  2. What is token-based authentication?
  3. Authentication versus Authorization
  4. Where to store JWT in browser? How to protect against CSRF?
  5. Non-random salt for password hashes
  6. JWT refresh token flow
  7. Cross Domain Login – How to log a user in automatically when transferred from one domain to another
  8. Where do you store your salt strings?
  9. SPA best practices for authentication and session management
  10. How do I store and retrieve credentials from the Windows Vault credential manager?
  11. Symfony2 extending DefaultAuthenticationSuccessHandler
  12. Best way for a ‘forgot password’ implementation? [closed]
  13. OAuth2 and Google API: access token expiration time?
  14. What is the best Distributed Brute Force countermeasure? [closed]
  15. Should I hash the password before sending it to the server side?
  16. How to do stateless (session-less) & cookie-less authentication?
  17. Using Symfony2’s AccessDeniedHandlerInterface
  18. How to manually decrypt an ASP.NET Core Authentication cookie?
  19. Secure Google Cloud Functions http trigger with auth
  20. Best practices for server-side handling of JWT tokens [closed]
  21. What are best practices for securing the admin section of a website? [closed]
  22. Securing an API: SSL & HTTP Basic Authentication vs Signature
  23. Fundamental difference between Hashing and Encryption algorithms
  24. Best way to handle security and avoid XSS with user entered URLs
  25. Why is using a Non-Random IV with CBC Mode a vulnerability?
  26. What should every programmer know about security? [closed]
  27. Is it safe to put a jwt into the url as a query parameter of a GET request?
  28. MVC 6 Bind Attribute disappears?
  29. How will a server become vulnerable with chmod 777?
  30. Keygen tag in HTML5

Leave a Comment