Multi-Factor Authentication and One-Time Codes
A password alone is one weak lock. Multi-factor authentication (MFA) adds a second, different kind of proof: something you know (password), something you have (phone, security key) or something you are (fingerprint). Stealing a password no longer opens the account.
Authenticator apps show a six-digit code that changes every 30 seconds. They use TOTP, built on HOTP (RFC 4226): the server and the app share a secret; each code is an HMAC of a counter (for TOTP, the current time divided into 30-second steps), cut down to six digits. Below is a working HOTP that reproduces the official test values from the standard.
Which is an example of 'something you have'?
Print the HOTP code for counter 3 using the same secret.
Finish the quick check (and any code exercise) to complete this lesson, or mark it done yourself.
Tip: use the left and right arrow keys to move between lessons.