Hello,

This is not specifically a Linux-related question, but I didn't know where to ask.

Since Twitter will soon remove SMS/text messages for 2FA, I installed and configured FreeOTP.

I'm having a hard time understanding how it works:

1. To add a new site ("token"), I have to use the app's embedded camera to take a picture of the site's QR code: What does it contain?
2. How does the app get the six-digit number, that's only usable for a short time? From the site through an Internet connection? In that case, does it mean OTP doesn't work if no Internet connection is available?
3. Likewise, how do hardware OTP keys get that number?

Thank you.

OTP systems are based on cryptographic algorithms. The idea is that both ends are "seeded" using the same number (probably the number in the QR code), and from then on they can generate the same pseudo-random sequence of numbers.

So no, these systems do not need an Internet connection in order to work.

1 members found this post helpful.

as it was mentioned, that number is a pseudo-random number, which means it looks like a real random number, but the same number is generated on the two devices (it looks like they are synchronized, but they are not connected to each other). This synchronization is based on a common seed or something similar, which is made only once, at the beginning, when you add a new site.
The generation of the [next] random number is based on a local algorithm, which is built into the hardware key, used by the site (in your case twitter) or your phone without using any external resources, therefore theoretically should work everywhere.

1 members found this post helpful.

Thanks, makes more sense.

https://www.geeksforgeeks.org/one-ti...-cryptography/

1 members found this post helpful.