Cross-site, TOTP-based two factor authentication
A host machine has a web browser. A user of the host machine also has a mobile device. A time-based, one-time password (TOTP) authentication scheme leverages a plug-in associated with the browser to automatically inject a received TOTP code into an element of an HTML-based TOTP authentication page, and to programmatically submit the HTML form (e.g., by mimicking the “click to submit” button on the TOTP form). Typically, the TOTP code is obtained following a successful completion of a push notification interaction between a cloud service, which stores TOTP shared secrets that are used to generate the TOTP codes, and the user of the mobile device.
1. A system, comprising:
a set of hardware processors each having memory associated therewith;
a mobile device authenticator app executed by a first processor of the set;
a network-accessible cloud service executed by a second processor of the set and having a data repository;
a browser plug-in adapted to be executed by a third processor of the set in an end user computing system distinct from the mobile device and the network-accessible cloud service;
the mobile device authenticator app operative to receive a scan of a first code from a TOTP authentication setup page at each site of a plurality of sites, to generate a TOTP shared secret per site based on the scan of the first code, and to forward to the cloud service the TOTP shared secret for each site;
the cloud service operative to store for the user the TOTP shared secret for each site;
the browser plug-in operative to detect display of a TOTP authentication page associated with a site, the site being one of a plurality of sites for which a TOTP shared secret has been obtained by the authenticator app;
the browser plug-in being further operative to respond to detection of the display of the TOTP authentication page to issue to the cloud service a request to initiate a push authentication interaction between the cloud service and the authenticator app;
the cloud service further operative in response to receipt of a push authentication interaction request to send a push notification to the authenticator app to determine whether TOTP-login to the site should proceed;
the mobile device authenticator app further operative in response to receipt of a confirmation of the push notification to notify the cloud service that TOTP login should proceed;
the cloud service further operative in response to receipt of the confirmation to use the TOTP shared secret for the site to generate a TOTP code, and to forward the TOTP code generated to the browser to enable the TOTP-login to be completed programmatically by the browser plug-in; and
the browser plug-in further operative to respond to receipt of a TOTP code generated by the cloud service upon a successful completion of the push authentication interaction to automatically inject the TOTP code into the TOTP authentication page and activate a login attempt from the TOTP authentication page, the TOTP code being generated dynamically after detection by the browser plug-in of the TOTP authentication page.
2. The system as described in claim 1 wherein the network-accessible cloud service includes an identity manager.
3. The system as described in claim 1 wherein the identity manager is associated with a web-based remote-access service.
4. The system as described in claim 1 wherein the authenticator app is used to obtain the TOTP shared secret per site for the user for each of the plurality of sites.
5. The system as described in claim 1 wherein the cloud service includes an application programming interface (API) over which the browser plug-in interaction occurs.
6. The system as described in claim 1 wherein the browser plug-in injects the TOTP code into an HTML fill-in form of the TOTP authentication page.
7. The system as described in claim 6 wherein the plug-in activates a login attempt from the TOTP authentication page by programmatically clicking a submit button on the TOTP authentication page.
8. The system as described in claim 1 wherein the mobile device authenticator app notifies the cloud service that TOTP login should proceed only when the confirmation of the push notification is received within a given timeout.
9. A method, comprising:
providing an authenticator app configured to be executed in a mobile device;
providing a cloud service that is network-accessible;
providing a browser plug-in configured to be executed in a user computing system that is distinct from the mobile device and the cloud service, the user computing system having an associated browser;
by the authenticator app: receiving a scan of a first code from a TOTP authentication setup page at each site of a plurality of sites, generating a time-based, one-time password (TOTP) shared secret per site based on the scan of the first code, and forwarding to the cloud service the TOTP shared secret for each site;
by the cloud service: storing for the user the TOTP shared secret for each site;
by the browser plug-in: (i) detecting display by the browser of a TOTP authentication page associated with a site, the site being one of the plurality of sites for which a TOTP shared secret has been obtained by the authenticator app, (ii) responsive to detecting display of the TOTP authentication page, obtaining a TOTP code by the following sub-steps: (a) issuing to the cloud service a request to initiate a push authentication interaction between the cloud service and the authenticator app; (b) responsive to the cloud service receiving a push interaction request, sending a push notification from the cloud service to the authenticator app to determine whether a TOTP-login to the site should proceed; (c) responsive to receipt of a confirmation of the push notification, the authenticator app notifying the cloud service that TOTP login should proceed, and (d) the cloud service thereafter using the TOTP shared secret for the site to generate the TOTP code and forward the TOTP code to the browser; (iii) automatically injecting the TOTP code into a fill in field of the TOTP authentication page, and (iv) automatically activating a login attempt from the TOTP authentication page wherein the TOTP code is generated dynamically after detection by the browser plug-in of the TOTP authentication page.
10. The method as described in claim 9 wherein the login attempt is activated from the TOTP authentication page by programmatically clicking a submit button on the TOTP authentication page.
11. The method as described in claim 9 wherein the TOTP code is injected by the browser plug-in into an HTML fill-in form of the TOTP authentication page.
12. The method as described in claim 9 wherein the authenticator app obtains the TOTP shared secret per site for the user for each of the plurality of sites.
13. The method as described in claim 9 wherein the authenticator app notifies the cloud service that TOTP login should proceed only when the confirmation of the push notification is received within a given timeout.
14. A computer program product in non-transitory computer readable media, the computer program product holding computer program instructions, the computer program instructions comprising (i) an authenticator app configured to be executed in a mobile device; (ii) a cloud service that is network-accessible; and (iii) a browser plug-in configured to be executed in a user computer system that is distinct from the mobile device and the cloud service, the user computing system having an associated browser, the computer program instructions executed to perform a set of operations, the operations comprising:
by the authenticator app: receiving a scan of a first code from a TOTP authentication setup page at each site of a plurality of sites, generating a time-based, one-time password (TOTP) shared secret per site based on the scan of the first code, and forwarding to the cloud service the TOTP shared secret for each site;
by the cloud service: storing for the user the TOTP shared secret for each site;
by the browser plug-in: (i) detecting display by the browser of a TOTP authentication page associated with a site, the site being one of the plurality of sites for which a TOTP shared secret has been obtained by the authenticator app, (ii) responsive to detecting display of the TOTP authentication page, obtaining a TOTP code by the following sub-steps: (a) issuing to the cloud service a request to initiate a push authentication interaction between the cloud service and the authenticator app; (b) responsive to the cloud service receiving a push interaction request, sending a push notification from the cloud service to the authenticator app to determine whether a TOTP-login to the site should proceed; (c) responsive to receipt of a confirmation of the push notification, the authenticator app notifying the cloud service that TOTP login should proceed, and (d) the cloud service thereafter using the TOTP shared secret for the site to generate the TOTP code and forward the TOTP code to the browser; (iii) automatically injecting the TOTP code into the TOTP authentication page, and (iv) automatically activating a login attempt from the TOTP authentication page, wherein the TOTP code is generated dynamically after detection by the browser plug-in of the TOTP authentication page.
15. The computer program product as described in claim 14 wherein the login attempt is activated from the TOTP authentication page by programmatically clicking a submit button on the TOTP authentication page.
16. The computer program product as described in claim 14 wherein the TOTP code is injected by the browser plug-in into an HTML fill-in form of the TOTP authentication page.
17. The computer program product as described in claim 14 wherein the authenticator app obtains the TOTP shared secret per site for the user for each of the plurality of sites.
18. The computer program product as described in claim 14 wherein the authenticator app notifies the cloud service that TOTP login should proceed only when the confirmation of the push notification is received within a given timeout.