<p>Many services implement 2FA (Two factor authentication) by sending
you a OTP (One Time Password) using an SMS with a random code, but this
forces you to give them your valuable phone number. What alternatives do
exist?</p>
<p>Let's dive into the <a
href="https://en.wikipedia.org/wiki/HMAC-based_one-time_password">HOTP</a>,
used by some banks years ago through a physical token and the recent <a
href="https://en.wikipedia.org/wiki/Time-based_one-time_password">TOTP</a>,
which both let you generate completely <em>offline</em> codes without
using any phone number or any other personal detail. They use the <a
href="https://en.wikipedia.org/wiki/HMAC">HMAC</a> technique usually
with a SHA-1 one-way hashing function, but other hashing functions can
be used too.</p>
<p>Useful links:</p>
<ul>
<li>a little visual explanation I found <a
href="https://www.onelogin.com/learn/otp-totp-hotp">here</a></li>
<li><a
href="https://f-droid.org/en/packages/com.beemdevelopment.aegis/">Aegis</a>
android OTP generator</li>
<li>use TOTP in KeepassXC for a desktop generator <a
href="https://keepassxc.org/docs/KeePassXC_UserGuide.html#_adding_totp_to_an_entry">guide</a></li>
</ul>
<p>Let's keep <a
href="https://en.wikipedia.org/wiki/WebAuthn">Webauthn</a> maybe for a
future episode, I'm still exploring it and have to do more research.</p>
