Blog

MFA: TOTP, Recovery Codes, Step-up Authentication and the Weakness of SMS

ASP.NET Core Identity's default authenticator provider accepts a TOTP code within ±2 time steps (five codes) and again and again, while NIST requires a code to be accepted once. We compute TOTP ourselves against the RFC 6238 test vector and show setup, lockout, a replay-protected provider, recovery codes, a step-up policy with the amr claim and the risks of SMS and 'remember this device' with real outputs.