Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I recently enabled two factor authentication for my Google account. One of the ways of getting the second factor (the key that I have) is to install an Android app on my phone that displays a key for a short duration of time.

What does it take to create a web server solution paired with a smartphone solution?

I am using Windows and .NET on the server side and would be interested in both Android and iPhone apps. Are there existing libraries out there or do I need to start from scratch? Where is some starting documentation and explanations of the techniques used?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

This blog post, Using Google Authenticator For Your Website, talks about using google authenticator in your own website.

The Google code provides a command line program that can generate secret keys as well as a PAM module, but it turns out to be very little code to authenticate a TOTP, thereby providing two-factor authentication to your website very easily.

Otherwise take a look at OATH which is an open OTP solution, there are a number of libraries and hardware solutions supporting this technology.

"How do I generate One time passwords (OTP / HOTP)?" might provide some insight as well.

I've also provided a client-only library for the yubikey on bitbucket. The library implements the client-side api for the hardware yubikey.

share|improve this answer
    
A lot of good information here. I am taking a look at the "GoogleAuthenticator for your Website" link. Thanks –  slolife Oct 19 '11 at 16:24

Look up cryptographic hash functions. The more popular ones, like SHA-1, should have libraries in almost every language. For example, android has the java.security.MessageDigest class. You would hash the current date and time down to the minute, together with a long string unique to the individual, then modify the output somehow to make it reasonable to type into a login dialog.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.