Passwords are in a pretty broken state of implementation for authentication. Posted in clock hacks, google hacks, Security Hacks Tagged 2FA, CircuitPython, ESP8266, google authenticator, ladyada, micropython, totp We’ve covered the ins and outs of 2FA applications before here at Hackaday if you’d like to know more about the concept, in addition to previous efforts to develop a hardware token for Google Authenticator. It’s worth noting here that this means your 2FA secrets will be held in clear-text on the ESP8266’s flash, so try not to use this to secure any nuclear launch systems or anything, OK? Then again, if you ever lose it the beauty of 2-factor is you can invalidate the secret and generate a new one. The calculation of the TOTP is handled by the Python code once you’ve provided it with the “secret” pulled from the Google Authenticator application. The time part is simple enough, as the ESP8266 can connect to the network and get the current time from NTP. You just need to know what time it is, and run an SHA1 hash. If you haven’t tried MicroPython before, grab an ESP and give this a roll.Ĭonceptually, TOTP is relatively simple. Software wise, the code is written in CircuitPython, a derivative of MicroPython, which aims to make microcontroller development easier. Naturally uses her own particular spin on both devices which you can purchase if you want to create an identical device, but the concept will work the same on the generic hardware you’ve probably already got in the parts bin. Generated codes can also be viewed via serial.įor the hardware, all you need is the ESP8266 and a display. With the hardware and source documented on her site, the makings of an open source Google Authenticator hardware token are available for anyone who’s interested. That sounds great, but what if you don’t have a smartphone? That’s the situation that recently found herself in, and rather than going the easy route and buying a hardware 2FA token that’s compatible with Google Authenticator, she decided to build one herself based on the ESP8266. With Google Authenticator, the combination of your user name and password along with the single-use code generated by the application allows you to securely authenticate yourself in a way that would be difficult for an attacker to replicate. Google Authenticator is a particularly popular smartphone application that can be used as a token for many two factor authentication (2FA) systems by generating a time-based one time password (referred to as TOTP).

Check google authenticator online