2factor auth

[seth vidal]

On Tue, 2011-10-18 at 01:07 +0200, Jan-Frode Myklebust wrote:
> On Mon, Oct 17, 2011 at 05:45:25PM -0400, seth vidal wrote:
> > > 
> > > Hopefully you aren't going to make this a requirement for all packagers.
> > > (I wasn't sure if Fedora committers referred to packagers or some other
> > > group.) I don't have any kind of cell phone right now (though work might
> > > buy me a dumb one in the future for work use) and buying one for Fedora would
> > > be pretty expensive.
> > 
> > 
> > to be fair - it doesn't require a smart phone - just a handheld device
> > running ios or android. Heck, I suspect it will probably run on the
> > android emulator.
> 
> Aren't the OTP-apps just a convenient alternative to generating,
> printing out and bringing along an OTP-list ? I.e. both should work. At
> least that's how I remember it from when I made my j2me-otp-app:
> 
> 	http://tanso.net/j2me-otp/
> 
> 

TOTP is just a value of time + your OTP secret + hashing ==  OTP.

TOTP has the virtue of only validating within a 30s window.

So I don't think printing out sheets would work unless you generated the
full list for every 30s within a given day.

I guess that's a sheet of paper with 1800 codes on it... That would
be.... irritating to carry around. Not impossible - just irritating.

-sv