Decentralized backup and recovery of TOTP secrets

Abstract

This work proposes a set of security, privacy, and usability design requirements for the backup and recovery systems of apps implementing the Time-based One-Time Password (TOTP) algorithm, a widely deployed method of two-factor authentication (2FA). We explain how several prevalent apps fail to satisfy these requirements and outline how our scheme leverages decentralized security techniques to satisfy the majority of these requirements and provide stronger security and privacy guarantees.