One Time Passwords in PHP and Google Authenticator

There is a neat app you can get on your Android Device or Iphone. It’s called Google Authenticator and it implements some RFC specified one time password mechanisms. It’s main use is to give you a two factor authentication for your Google account. But it’s not limited to that. In fact, you can use it for your very own page or app and use it as a two factor authenticator. Because the app is by Google, you don’t have to worry about building that thing and getting it into the app stores, but you can simply use the preexisting application for your own needs.

In the latest update it added the rights for internet access to the android app, though only for time syncronization. Besides that, the app does not talk to the internet, and this, only when you tell it to.

So how does this work?

You create a secret that is saved with your local user, like a password, but they don’t really need to know that secret. You share that secret with the Google authenticator app through a QR code). From now on, every 30 seconds, your device shows a new one time password. As long as your time is in sync with the server, you will see the same code, the server will generate from your secret. Once you used the code, the server will make note (or should) and not allow that code to be used anymore for the next couple minutes. So even if someone can listen to your conversation you have with the server and replay it an instant later, they will be unable to login because the password no longer grants you access.

To make life easier, I created some classes (and unit tests) to take care of the complicated bits for you. You can get the otp classes on Github. Feel free to use it any way you like. If you do use it, or get stuck, contact me. I always like to hear where things I made are used. Of course also feel free to give feedback, fork the code and improve it.