Google Authenticator should be used instead. It is drop-dead easy to implement.
This is the entirety of the code needed to compute a Google Authenticator 6-digit code in C#, given the 10-byte secret and the current time. This is like 20 lines of code at the most!
///
/// Calculates the current One Time Password for a secret.
///
public static string CalculateOneTimePassword(byte[] Secret, Int64 currentUnixTimestamp) {
if (Secret==null || Secret.Length != 10) return null;
Int64 Timestamp;
byte[] Hmac;
int Offset;
int OneTimePassword;
// https://tools.ietf.org/html/rfc4226
Timestamp = Convert.ToInt64(currentUnixTimestamp / 30L);
var data = BitConverter.GetBytes(Timestamp).Reverse().ToArray();
Hmac = new HMACSHA1(Secret).ComputeHash(data);
Offset = Hmac.Last() & 0x0F;
OneTimePassword = (
((Hmac[Offset + 0] & 0x7f) << 24) |
((Hmac[Offset + 1] & 0xff) << 16) |
((Hmac[Offset + 2] & 0xff) << 8) |
(Hmac[Offset + 3] & 0xff)
) % 1000000;
return OneTimePassword.ToString("000000");
}
The 10-byte secret is a randomly generated number, and can be programmed into the user's phone by showing an on-screen QR code of the following format:
otpauth://totp/USERLOGINNAMEHERE?secret=SECRETHERE
where USERLOGINNAMEHERE is text that will be shown to the user to identify their account, and SECRETHERE is the 10 bytes converted into Base32 using the following alphabet: ABCDEFGHIJKLMNOPQRSTUVWXYZ234567 (yields a 16-character string, 'A' has the value 0)
Indeed, it seems to do the job. I most admit that I use both Google two-factor authentication on my iPhone
to sign in, just a random seed on the image in case anyone wondered.
I then use Secure Card which I have printed out, because this will hide the secure card in the system so I only have it on paper
as well, before I am granted access to my account and to send bitcoins.
Could be I am a little paranoid but with all the hacks and cracks you read about, I am in the state of mind that better safe then sorry.
-
aadje93, sorry for your loss. Is there anything I can do to help you out?
