How to Set Up Two-Factor Authentication for Login and Sudo

If your virtual machine can't sync with an NTP time server for an extended period of time (outbound security group), it will drift beyond 30s from actual time (just saw this in AWS about a year go).

App also supports HOTP.

Which is annoying because now you cannot have an authenticator on multiple devices. With TOTP as long as you know the secret and time you can spin up Google Authenticator on anything and it will work, with HOTP you have the counter synchronization problem. This also makes backups a much MUCH bigger challenge.

That being said, HOTP is theoretically more secure than TOTP because even if the secret is exposed (e.g. old backup) they'd still need to crack the counter. It also does avoid clock problems.

I almost think the ideal solution would be to set up TOTP primarily and HOTP as a backup. Two different accounts, and you take the HOTP secret (likely QR code), print it, hide it, and destroy the digital copy.

> it does state it supports "emergency scratch codes" as well as HOTP -- from looking at the code again, I think they are considered the same thing, and it appears if you enter a scratch code

No. HOTP and TOTP are treated separately. Both of which are separate from scratch codes.

HOTP can't "show the future" (well, you can generate multiple codes but it won't be useful for this) and have an order. Scratch codes are exactly N of them, and they're stored in ~/.google_authenticator and don't have an order. They're also twice as long because unlike the normal codes there's 8 (IIRC) valid ones, and they're ALL valid all the time. (until used)

Yeah, I mean if the goal is the "enterprise" solution, which is usually the solution where the setup, as well as the risk and damages of a break-in, can be shouldered to another company, then yeah RSA is usually the answer. I was primarily referring to the cryptographic security. Yes, RSA does avoid the transfer of plaintext secrets over the network, but instead you are placing your trust in RSA as a company to not have stored the secrets elsewhere (which, in most cases, is probably just fine).

The advantage of U2F is that it uses an asymmetric scheme where a keypair is generated for each authentication endpoint, so the secrets never leave the hardware token in the first place. Compared to RSA SecurID, you would need to have a really severe threat scenario such that you can't even trust RSA with your keys. Of course, U2F is also a much more complicated protocol than say TOTP, and has not existed long enough to stand the cryptographic test of time.

To answer your second question, I'm not sure I understand what you mean. TOTP (Google Authenticator), RSA SecurID, and U2F are all different types of 2FA. They could all be combined with Kerberos if that is what you want.