Stan
New Member
- Nov 14, 2025
- 4
- 5
Hello Ahwoo.
Today I received an email from you regarding "recovery authentication codes" because I had set up TOTP as my two-factor authentication (2FA) method. In your e-mail you are saying that 12 recovery codes have been created and will be presented to me the next time I log in. As a software developer, who has written TOTP applications for clients and servers, I feel compelled to explain why these "recovery codes" undermine the security model of TOTP.
Unlike passwords, with TOTP users do not send a fixed password or code to your server. A random secret, together with the current time, is beind used to generate a 6-digit PIN every 30 seconds. In theory, this allows testing one million PINs every 30 seconds. In practice, a server usually limits the number of attempts to just a few. The inherent security concept of TOTP is to a) prevent using a static code, and b) limit the validity of PIN codes to 30 seconds.
Your "recovery authentication codes" are undermining this very security concept by creating static codes, which never change by themself and in fact can never be changed by the user. Furthermore you are increasing the total amount of valid 2FA credentials from 1 to 13. That's like asking someone to use 12 additional passwords to his already existing password - except that these "passwords" are created by you and cannot be changed by the user.
Another issue I found, is that these recovery codes apparently do not reset, even after disabling 2FA and enabling it again. That means that if these recovery keys ever get compromised, they will remain valid forever and the entire 2FA becomes therefore permanently useless / insecure, since there is no way for the user to change them.
This is a misunderstanding of the TOTP concept and it effectively reduces the security of this 2FA method. Please consider removing these "recovery authentication codes". If you insist on offering a backup method, a better solution would be offering your users the option to set up a second e-mail address or set up an optional phone number through which users can restore their access to their account (to clarify: not automatically, but with a manual review).
Today I received an email from you regarding "recovery authentication codes" because I had set up TOTP as my two-factor authentication (2FA) method. In your e-mail you are saying that 12 recovery codes have been created and will be presented to me the next time I log in. As a software developer, who has written TOTP applications for clients and servers, I feel compelled to explain why these "recovery codes" undermine the security model of TOTP.
Unlike passwords, with TOTP users do not send a fixed password or code to your server. A random secret, together with the current time, is beind used to generate a 6-digit PIN every 30 seconds. In theory, this allows testing one million PINs every 30 seconds. In practice, a server usually limits the number of attempts to just a few. The inherent security concept of TOTP is to a) prevent using a static code, and b) limit the validity of PIN codes to 30 seconds.
Your "recovery authentication codes" are undermining this very security concept by creating static codes, which never change by themself and in fact can never be changed by the user. Furthermore you are increasing the total amount of valid 2FA credentials from 1 to 13. That's like asking someone to use 12 additional passwords to his already existing password - except that these "passwords" are created by you and cannot be changed by the user.
Another issue I found, is that these recovery codes apparently do not reset, even after disabling 2FA and enabling it again. That means that if these recovery keys ever get compromised, they will remain valid forever and the entire 2FA becomes therefore permanently useless / insecure, since there is no way for the user to change them.
This is a misunderstanding of the TOTP concept and it effectively reduces the security of this 2FA method. Please consider removing these "recovery authentication codes". If you insist on offering a backup method, a better solution would be offering your users the option to set up a second e-mail address or set up an optional phone number through which users can restore their access to their account (to clarify: not automatically, but with a manual review).
Last edited:
Upvote
0
