Those numbers fall into the category of TOTP – Time-based, One-Time Passwords.
TOTP is now required in many places – from government service websites through email accounts to Facebook, almost everywhere.
How do they work – from the outside?
First, we’re asked to install an authentication app on our smartphone.
Then, ideally, they give us a strange square filled with black-and-white patterns – known as a QR code – which we have to scan with our phone; the authentication app then displays a six-digit code along with a name.
From then on, whenever we want to log in to a service that requires TOTP – be it the Government Portal, an email account, Facebook or anything else – after entering our password, we’ll be asked for that six-digit number, which changes every half a minute.
How do they work – from the inside?
It’s a fair question, given that TOTP works even when your smartphone has no internet connection. How?
It’s simpler than you might think. Once set up, it works without the internet because it doesn’t need an internet connection to function.
When you scan the QR code, you aren’t connecting your phone to any other device. Using the QR code, we copy an encryption key onto our phone.
All the TOTP app does is take the current time, divide it by thirty, combine this result with the encryption key, and truncate it to six digits.
Meanwhile, the service that requires this TOTP carries out exactly the same operation, using the same elements. So nothing is sent anywhere – the two systems arrive at the same result independently.
This process does not require an internet connection; it only requires the exact time, which is already on your phone, and the encryption key, which has just been copied onto the phone.
As its internal workings show, there is an internal logic to the ‘generation’ of the number sequence; therefore, it does not, in itself, provide complete security – it is a necessary but not sufficient element of proper IT security.
Vélemény, hozzászólás?