Guide to Building TOTP Two-Factor Authentication Without Libraries in Node.js and Python

·3 views

A developer explains that most TOTP 2FA tutorials skip security-critical details like verification windows, code reuse prevention, rate limiting, and recovery. The guide follows RFC 4226 (HOTP) and RFC 6238 (TOTP), providing Node.js and Python implementations that use only standard libraries and pass the official RFC test vectors. It walks through the HOTP and TOTP algorithms, including dynamic truncation and the time-step counter. It also recommends parameter choices such as SHA1, 6 digits, a 30-second period, and 160-bit secrets, with reasons for each. Finally, it covers a server-side enrollment flow that generates secrets securely, stores them encrypted, and keeps them pending until verified, alongside a companion browser tool for generating QR codes and checking codes.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Checking app ideas against App Store data before building them

The author argues that cheap AI-assisted development doesn't make choosing the right app idea cheap, so they now test ideas against real store data first. The method uses Apple's free iTunes Search API to pull ratings counts, average ratings, prices and update dates for competing apps. Each idea is scored from 0 to 10 on demand, competition and revenue, with an average of 7.5 or higher suggesting a build. In the example of an ADHD habit tracker, the top competitor was free and had 768k ratings, yielding a 5.0 score and a recommendation to skip unless the idea was repositioned. The author also suggests reading low-star reviews of competitors to find recurring complaints, and has packaged the workflow into an Apify Actor tool.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Designing Empty States: Decide What the Page Must Explain Before the Illustration

An empty dashboard can look unfinished when blank, yet an oversized illustration can make a serious app feel like a greeting card. The article argues that designers should first determine what the empty page needs to communicate. Using a bookmarks app, it contrasts a new-account state, which calls for a prompt to save a first link, with a no-search-results state, which calls for different guidance and a clear action. Illustrations should be tied to a specific state and kept simple, with a concise brief and a generation prompt suited to that context. Designers are advised to review the visual at its actual display size and to keep essential instructions in editable HTML text rather than inside the image.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Comparison of 11 AI Design-to-Code Tools Assesses Accuracy, Integration and Developer Control

A developer on DEV Community reviewed eleven AI tools that convert design files into code, drawing on client project experience. The evaluation compares the tools on design accuracy, code integration, functionality, and the degree of control they give developers. The author argues that the best choice depends on a team's particular workflow rather than on any single universal winner. The piece is presented as a practical guide for developers picking a tool for their next project.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Agent Finds Signup Refusals Vary by Platform, Then Confronts Lack of Real Presence

An AI agent spent a week being refused by signup forms, with Reddit rejecting the same email address twice while Royal Road banned its domain and Medium accepted it immediately. The author realized each platform runs its own separate reputation check, so refusals apply only to individual doors rather than the address itself. Even after gaining access to Medium, the account stayed empty for three days because no post had been written. The author argues that having an account without a contribution still leaves one a stranger, and invites readers to share experiences of being shut out.

0 comments Read more at DEV Community