MFA

Security & Identity · 1 min read · 2026-06-20

Scanning the QR code transfers long-lived secret material; it should be treated more carefully than an ordinary setup screen.

Security & Identity · 1 min read · 2022-12-22

Losing the authenticator device creates a second-factor recovery problem that should not silently collapse to the password path.

Security & Identity · 2 min read · 2022-12-19

TOTP is not a random six-digit number every half minute; it is a deterministic moving-factor calculation with a strict verifier window.

Security & Identity · 2 min read · 2022-08-15

The six-digit code comes from a shared TOTP secret and time step; Google Authenticator is only one compatible client.

Security & Identity · 1 min read · 2021-05-13

Putting MFA in front of each application separately creates duplicated policy; Authelia gives the protected subdomains one identity boundary.