←back to thread

Behind the 6-digit code: Building HOTP and TOTP from scratch

(blog.dogac.dev)
250 points dogacel | 1 comments | 11 Apr 25 13:06 UTC | HN request time: 0.205s | source
Show context
jqpabc123 ◴[16 Apr 25 12:07 UTC] No.43704333[source]▶
I implemented TOTP as a command line app doing lookup and generation by pulling secrets from a locally encrypted password file.

And before someone asks, the decrypt key is only stored in my head and the app fails silently after a significant delay if the decrypt fails.

What I don't get is how HOTP is anything but a fail waiting to happen if used across an unreliable network. Maybe this explains why I have yet to encounter a real world deployment of HOTP.

replies(2): >>43705511 #>>43709099 #
1. GoblinSlayer ◴[16 Apr 25 13:47 UTC] No.43705511[source]▶
In my experience HOTP works fine, why not. The real world deployment is a replacement for sms otp.