A question about apps

[jberryhill]

1. there are a number of them

Google authenticator is pretty standard.

Do you remember those key fob things that some systems used to have, where you had to carry around a key fob with a little LCD screen that had a six digit number on it that would change every 30 seconds or a minute?

Authenticator apps are the same thing, just a software implementation in a device you already carry around.

The only thing they do is to follow an algorithm that produces a pseudo random number at regular intervals. The algorithm is seeded with a value that produces a sequence of numbers that can only be predicted by a machine running the same algorithm with the same random number.

The way you synch up is that the secure system generates the seed and you provide the seed to your device (usually through a QR code) so that your device and the secure system know the seed.

Then, from that point on, the secure system can verify that you are the holder of the device by asking you to provide the current number produced by your device running that sequence.

The only thing the app does is to (a) check what time it is, and (b) produce the pseudo random number based on the time and the seed.

On edit:

https://en.wikipedia.org/wiki/Multi-factor_authentication#Use_of_mobile_phones