What it is
TOTP stands for Time-based One-Time Password. It is defined in RFC 6238 and builds on HOTP from RFC 4226. The server and the user's authenticator app share a secret, usually set up by scanning a QR code. Each side combines that secret with the current time to produce the same short code. A code is only valid for a short window.
Codes are typically six digits and change every 30 seconds. Because the code comes from the shared secret and the clock, it works offline and needs no text message. Most authenticator apps support it, which is why it is a common second factor for sign-in. Someone who steals a password still needs the phone that holds the secret.
How I use it
- TOTP two-factor sign-in is live on Rental Pilot's API, web app and phone app.
- Codes come from the user's own authenticator app.
- Sits beside the other sign-in controls listed on the security page, including bcrypt-hashed passwords and a password policy on every new or changed password.
TOTP is the right tool when a stolen password alone should not be enough to get in, and you do not want to depend on text messages. I reach for it because it is an open standard that works with the authenticator apps people already have, and it adds a real second step without per-message costs.
Questions
Does Rental Pilot support two-factor authentication?
Yes. Sign-in codes from an authenticator app (TOTP) are available on the web app, the phone app and the API behind them.
Why authenticator codes instead of text messages?
Authenticator codes are generated on the phone from a shared secret and the time, so they do not depend on a phone carrier or a message getting through. They also cost nothing per sign-in.