HeadlinesBriefing favicon HeadlinesBriefing.com

mTOTP: Manual TOTP for Human-Only 2FA

Hacker News: Front Page •
×

The GitHub project mTOTP introduces an experimental, manual variant of time-based one-time passwords, designed for calculation without electronic devices. It outlines a deterministic, 7-step algorithm involving a secret numeric key and a planned login time, producing a 6-digit code. The protocol prioritizes mental tractability over cryptographic equivalence, exploring authentication under strict human constraints.

This approach shifts time from an approximation to an intentional parameter in authentication. By requiring users to precompute OTPs for a specific future moment, mTOTP challenges the standard reactive model of 2FA. Its design emphasizes clarity and reproducibility, making it a niche tool for scenarios where device dependency is a limitation or a philosophical experiment in human-computable cryptography.

The project includes a PAM module for integration and a demo, with a Keycloak plugin planned. While not intended for production security, it sparks discussion on the boundaries of manual authentication. Its practical application may be limited, but it serves as a tangible exploration of human-performed cryptographic primitives and the trade-offs involved.