Hack the Route Start free Open app Identity and access
Multi-factor authentication
Requiring more than one kind of proof to log in, such as a password plus a time-based code from a device.
Factors come in kinds: something you know (a password), something you have (a phone, a hardware key),
something you are (a fingerprint). Requiring two different kinds means a stolen password alone is not enough. The
common second factor is TOTP: the server and an authenticator app share a secret once, and each turns that secret
plus the current time into the same six-digit code, valid for about 30 seconds. On Linux, pam_google_authenticator
checks the code and oathtool --totp computes one. A TOTP code is one-time and time-bound, so a captured
code is quickly useless; but the seed is a shared secret that, if it leaks, lets anyone make the codes, which is why
phishing-resistant factors (hardware keys, passkeys) that never reveal a copyable secret are stronger.