Time Based One-Time Passcode

Benefits of Time-Based One-Time Passcode (TOTP)

Time-Based One-Time Passcodes (TOTP) are a form of two-factor authentication (2FA) that significantly enhance the security of online accounts and systems. TOTP is based on a time-synchronized secret key between the user and the server. Here are the key benefits:

  1. Enhanced Security: TOTP generates a unique passcode that expires after a short time (usually 30 seconds). Even if a hacker intercepts the code, it will be useless after it expires, reducing the risk of unauthorized access.

  2. Protection Against Phishing: Since the code changes every few seconds, it's very difficult for attackers to use it even if they manage to steal it. Unlike static passwords or one-time codes sent via SMS, TOTP codes cannot be reused, providing an additional layer of protection.

  3. No Need for Internet Connectivity: TOTP works offline. The secret key and time synchronization allow the generation of passcodes even without an active internet connection, making it ideal for environments with limited or no connectivity.

  4. Better User Experience: Unlike hardware tokens or SMS-based authentication, TOTP can be generated using smartphone apps (like Google Authenticator or Microsoft Authenticator), which many users are already familiar with. This makes it easy to set up and use.

  5. Widely Adopted and Easy to Implement: Many online services and applications support TOTP, including financial institutions, social media, and cloud service providers. Implementation is relatively simple for developers and organizations, making TOTP a versatile and effective security tool.

Instructions for Using Time-Based One-Time Passcode (TOTP)

1. Download a TOTP App

To get started, you need to install an authenticator app on your smartphone or desktop/laptop. Options include:

2. Set Up TOTP with Online Banking

  1. Log in to Online Banking

  2. Enable Two-Factor Authentication (2FA): Go to the My Settings link, scroll to Security Options, and then click Edit. Click OFF at the By authenticator section, enter your current password and click Save to security settings of your account.

  3. Scan the QR Code: The service will display a QR code that contains a secret key for generating time-based passcodes. Open your authenticator app, and choose the option to add a new account or scan a QR code.

  4. Enter the Code from the App: After scanning the QR code, your app will start generating 6-8 digit passcodes at regular intervals (usually every 30 seconds). Enter the code displayed on your app into the service's setup page to verify the link between the app and the service.

  5. Save Backup Codes: Many services will also provide backup codes during setup. These codes can be used if you lose access to your authenticator app. Save them in a secure place.

3. Logging In Using TOTP

  1. Enter Your Username and Password: First, input your regular login credentials (username and password).

  2. Enter the One-Time Passcode: After entering your password, the system will prompt you for a code. Open your authenticator app and retrieve the current code (which changes every 30 seconds), and enter it on the login screen.

  3. Access Granted: If the code is correct, you'll be granted access to your account or application. If not, you'll need to wait for the code to refresh (typically every 30 seconds) and try again.

  4. Register your device: to avoid having to use TOTP every time you login, you can register your device. If you log in from different device you will need to use TOTP until that device is registered.

4. Maintaining Security

  • Do Not Share the Secret Key: If you manually configure TOTP (instead of scanning a QR code), never share your secret key with anyone. It’s important for the security of your account.

  • Keep Your Device Secure: Since the TOTP code is generated on your device, it's essential to keep your phone or device secure by using a password, biometric authentication, or similar methods.

  • Synchronize Time Regularly: TOTP depends on accurate time synchronization. Ensure your device's time is correct and synchronized with an NTP (Network Time Protocol) server, especially if you notice errors in code generation.