Bifalgorithm post

"Your authenticator app doesn't need the internet. Here's why. Turn on airplane mode. No Wi-Fi, no mobile data. Now open Google Authenticator, Microsoft Authenticator, or any similar app. The six-digit code still changes every 30 seconds. And if you try that code on the website, the server can still accept it. So how are your phone and a server somewhere else generating the exact same code without talking to each other? Here's how it works. When you first enable two-factor authentication, the QR code you scan isn't continuously connecting your phone to the server. Instead, that QR code contains a secret key. Your authenticator app stores that secret key, and the server stores the same secret key. That shared secret is the important part. Now every 30 seconds, both sides do essentially the same calculation. First, they look at the current Unix time, then they divide time into 30-second windows. So if your phone and the server have roughly the correct time, they both calculate the same time window. Then they combine that time value with the shared secret and run it through a cryptographic function, usually HMACE-EDGE, one in standard TOTP. That produces a much larger value. But obviously nobody wants to type a giant cryptographic number every time they log in. So the algorithm extracts part of that result, converts it into a number, and then takes the remainder after dividing by one million. And that gives you a six-digit code. So your phone might independently calculate. 482731. And at the same moment, the server calculates 482731. They never sent that code to each other. They simply arrived at the same answer because they started with the same secret and the same time. That's why your authenticator app still works completely offline. And servers normally allow a small time window around the current code, too, because clocks can be a few seconds out of sync. Now, this general idea appears in a lot of security systems. Two systems share a secret, then use that secret to generate or verify cryptographic values without sending the secret itself. Webhook signatures, signed API requests, and message authentication codes use related ideas. So the important takeaway is this. Your authenticator app is not downloading six-digit codes from the server. It generates them locally, and the server independently generates the same expected code using the same secret, the same time window, and the same algorithm."

"Your authenticator app doesn't need the internet. Here's why. Turn on airplane mode. No Wi-Fi, no mobile data. Now open Google Authenticator, Microsoft Authen…