mintotp VS google-authenticator

Huh? Who is saying you need a smartphone? PyPi accepts TOTP as 2FA. TOTP is an open standard that has been around for at least a decade already and is very easy to implement, literally 20 lines of python. There are a ton of TOTP applications available, from CLI, to GUI on desktop systems, to Android apps, iOS, etc. If you have any device, be it a computer, phone, tablet, etc., which you do since you need one to publish the code from, you can easily generate TOTP codes. Heck, you could even do it by a hand on a paper.

A little golfed, but TOTP in python, using included modules, is not much code.

https://github.com/susam/mintotp/blob/main/mintotp.py

mintotp – Minimal TOTP generator in 20 lines of Python

There was a HN post the other day demonstrating MinTOTP, a tiny TOTP generator in Python.

Documented in this project's README here: https://github.com/susam/mintotp#alternative-oath-toolkit

otpauth:// is a de-factor standard, since Google Authenticator uses it: https://github.com/google/google-authenticator/wiki/Key-Uri-...

Random question if you're using TOTP why not just give the user the secret when signing up as a Google Authenticator URI encoded in a QR code? Then you won't need to futz around with sending it to them afterwards. You can even use a library like qrcode.js so you don't generate the barcode server side either.

Locker can generate Time Based OTP codes parsing TOTP urls stored under a special key named totp.

(Examples> https://github.com/google/google-authenticator/wiki/Key-Uri-Format)

If we're talking about the encrypted Authy TOTP secrets and IF they get cracked or guessed, Authy does store the email in the name of the item. Having the name, service and the secret within the QR code's URI is normal and the standard for TOTP. The only thing the hackers won't have is the password.