Computer Science
Grade 9
20 min
Two-Factor Authentication
Two-Factor Authentication
Tutorial Preview
1
Introduction & Learning Objectives
Learning Objectives
Explain the difference between the three main authentication factors (knowledge, possession, inherence).
Analyze the security trade-offs between SMS-based 2FA and authenticator app 2FA.
Describe the high-level algorithmic flow of a Time-based One-Time Password (TOTP).
Identify potential vulnerabilities in 2FA systems, including phishing and SIM swapping.
Evaluate the critical role of backup codes and recovery options in a 2FA setup.
Design a simple flowchart for a login process that incorporates a 2FA check.
Ever wonder why your favorite game asks for a code from your phone even after you type your password? 🤔 Let's dive into the advanced tech that makes this super-strong security possible!
In this lesson, we'll move beyond just knowing *what*...
2
Key Concepts & Vocabulary
TermDefinitionExample
Authentication FactorA category of credential used to verify a user's identity. Security experts group them into three types: something you know, something you have, and something you are.A password is a 'knowledge' factor. Your phone with an authenticator app is a 'possession' factor. Your fingerprint is an 'inherence' factor.
TOTP (Time-based One-Time Password)An algorithm that uses a shared secret key and the current time to generate a temporary, single-use passcode.The 6-digit code you see in Google Authenticator or Authy that refreshes every 30 seconds.
Shared Secret KeyA unique piece of data known only to the user's device and the server. It's the 'seed' used by the TOTP algorithm to generate matching codes...
3
Core Syntax & Patterns
TOTP Generation Logic
GeneratedCode = Truncate( HMAC(SharedSecret, CurrentTimeStep) )
This pattern shows how a TOTP is created. A cryptographic function (HMAC) mixes the Shared Secret with the current time (rounded to a 30-second step). The long result is then shortened (truncated) to a 6-digit code that's easy for a human to type.
2FA Verification Flow
IF (Password_Is_Correct) THEN Request_And_Check_Second_Factor() ELSE Deny_Access()
This is the fundamental logic for a secure login process. The system must always verify the first factor (password) is correct *before* asking for the second. This prevents attackers from discovering which accounts have 2FA enabled.
Factor Independence Principle
Compromise_of_Factor1 should NOT lead to Compromise_of_Factor2
A core...
4 more steps in this tutorial
Sign up free to access the complete tutorial with worked examples and practice.
Sign Up Free to ContinueSample Practice Questions
Challenging
An attacker sets up a perfect fake login page (a phishing site) that passes the user's credentials to the real site in real-time. The user enters their password and their TOTP code from an authenticator app into the fake site. The attacker immediately uses these on the real site. This advanced attack can succeed because...
A.The TOTP code is valid for anyone to use during its 30-second window.
B.The attacker managed to steal the Shared Secret from the user's phone.
C.The authenticator app is not encrypted.
D.The user's password was too simple.
Challenging
A server's clock is running exactly two minutes fast. A user with a perfectly synced phone tries to log in using their TOTP authenticator app. What will be the outcome?
A.The login will succeed without any issues.
B.The login will fail because the server and the app will generate different codes.
C.The login will succeed, but the server will log a security warning.
D.The user's authenticator app will show an error and stop generating codes.
Challenging
A system allows users to choose between a fingerprint scan (inherence) or an authenticator app (possession) for their second factor. What is a key security trade-off when considering the possibility of a remote attack (where the attacker is not physically present)?
A.fingerprint can be copied, while an app code cannot.
B.An app code can be phished, while a fingerprint cannot be transmitted to a remote attacker through a simple web form.
C.fingerprint is more secure because it is unique to the user.
D.An app is less secure because the phone could be stolen.
Want to practice and check your answers?
Sign up to access all questions with instant feedback, explanations, and progress tracking.
Start Practicing Free