How does Google Authenticator work?
A gist why you should care to read?
Security and privacy have become a major concern not only for businesses but also for generic customers. Thus providing additional security layers for applications is something in demand even for customer-facing apps.
You would have already heard or the daily apps you use would have advised you to set up two-step password verification for it. If you’re someone who uses Github, Gmail, or similar tools to great extent changes are high that you might already have the Google authenticator app installed and two-step verification set up.
Have you ever wondered how it works? Have you tried to input codes a bit delayed and noticed it getting passed through sometimes? Have you ever wondered how it’s synchronized between the applications?
These are really interesting and common questions that would obviously pop up if you’re a curious mind and enjoy tech. I’m a frontend developer and I knew it’s not something that’s directly related to my profile. However curiosity is the mother of invention and in this fast ever-changing world if you’re getting a chance to experiment with something diversified beyond your profile, why not gift some for it?
Trust me it’s going to be really short breakdowns!
What problem does it solve?
Two-step verification adds a layer of security concerning the conventional password authentications our applications might have.
Here we are can make use of something called One Time Password Generation that one can likely carry with them which would constantly generate passwords dynamically.
If you have already Googled about it a bit, you might have crossed with fancy terms like HOTP/TOTP, timers, Hash, HMAC, etc.
Get Mariappan’s stories in your inbox
Join Medium for free to get updates from this writer.
Let’s make this intuitive and simple. What else could be better than handwritten notes? I don’t want you to be tired of reading more & more paragraphs. Let me just jot down simple illustrations and key points.
Key points:
- Two key things to note — a counter & a secret
- Secret — Base 32 encoded (default)
- Counter — which ticks every 30 seconds generating a new password
- Algorithm — can be SHA1 (HMAC)
- HOTP — Hash-based One Time Password
- TOTP — HOTP + time based instead of counter — Time-based One Time Password
PDF link for the same below. Bare with the handwriting, should’ve drafted if with little consciousness I’d be sharing it in public 😆
Other interesting facts
- The mechanism is usually highly designed with high flexibility to provide users with better experiences. That changes are high user typing speed may vary, internet speed could affect, etc. These need to be taken care of when such systems are designed.
- In order to set up — you’ll get a base-32 encoded secret which is eventually common on both ends (server and application). This is usually provided in the form of a QR code for an enriched experience. (However, the user can choose other options available if preferred)
Fun tweak
I tried decoding one such code, and this is what the bare minimum structure of decoded URI looks like,
otpauth://totp/Google%3A[your-name]%40[org-name]?secret=[your-secret]&issuer=GoogleIf you have any suggestions, need some help/doubts, or wish to discuss more on any tech topics please write to me at mariappangameo@gmail.com. I’d also love to connect with you all on Linkedin — https://www.linkedin.com/in/marigameo
