Cross-site, TOTP-based two factor authentication
A host machine has a web browser. A user of the host machine also has a mobile device. A time-based, one-time password (TOTP) authentication scheme leverages a plug-in associated with the browser to automatically inject a received TOTP code into an element of an HTML-based TOTP authentication page, and to programmatically submit the HTML form (e.g., by mimicking the “click to submit” button on the TOTP form). Typically, the TOTP code is obtained following a successful completion of a push notification interaction between a cloud service, which stores TOTP shared secrets that are used to generate the TOTP codes, and the user of the mobile device.
1. A computing device operative in association with a mobile device of a user, the mobile device being distinct from the computing device and having an authenticator app that enables a time-based, one-time password (TOTP) two factor authentication, comprising:
a processor; and
computer memory storing computer program instructions comprising a browser, and a browser plug-in executed in the browser;
the browser plug-in executed in the browser and configured to detect display by the browser of a TOTP authentication page associated with a site, the site being one of a plurality of sites for which a TOTP shared secret has been obtained by the authenticator app, the TOTP shared secrets for the plurality of sites being stored in a cloud service that is distinct from both the computing device and the mobile device;
the browser plug-in executed in the browser further configured to respond to detection of the display of the TOTP authentication page to issue to the cloud service a request to initiate a push authentication interaction between the cloud service and the authenticator app, and to respond to receipt of a TOTP code generated by the cloud service upon a successful completion of the push authentication interaction to automatically inject the TOTP code from the browser plug-in and into the TOTP authentication page displayed by the browser and activate a login attempt from the TOTP authentication page;
wherein the browser plug-in is implemented as one of: a plug-in, an applet, an object-oriented programming control, a script, and native code.
2. The computing device as described in claim 1 wherein the browser plug-in injects the TOTP code into an HTML fill-in form of the TOTP authentication page.
3. The computing device as described in claim 1 wherein the browser plug-in activates a login attempt from the TOTP authentication page by programmatically clicking a submit button on the TOTP authentication page.
4. Apparatus, comprising:
a processor; and
computer memory storing computer program instructions comprising a browser, and a browser plug-in executed in the browser;
the browser plug-in executed in the browser and configured to detect display by the browser of a time-based, one-time password (TOTP) authentication page associated with a site;
the browser plug-in executed in the browser further configured to respond to detection of the display of the TOTP authentication page to receive a TOTP code, to automatically inject the TOTP code from the browser plug-in and into a fill-in field of the TOTP authentication page displayed in the browser, and to automatically activate a login attempt for a user from the TOTP authentication page following injection of the TOTP code into the fill-in field to thereby complete a second step of a two-factor authentication, wherein the TOTP code is generated dynamically after detection by the browser plug-in of the TOTP authentication page;
wherein the browser plug-in is implemented as one of: a plug-in, an applet, an object-oriented programming control, a script, and native code.
5. The apparatus as described in claim 4 wherein the browser plug-in activates the login attempt from the TOTP authentication page by programmatically clicking a submit button on the TOTP authentication page.
6. The apparatus as described in claim 4 wherein the browser plug-in receives the TOTP code from an external source in which the TOTP code is generated.
7. The apparatus as described in claim 4 wherein the TOTP code is received following a successful completion of a push authentication interaction associated with a mobile device, the mobile device being associated with the apparatus.
8. The apparatus as described in claim 4 further including a data stores a TOTP shared secret for the user for the site.
9. The apparatus as described in claim 8 wherein the TOTP is dynamically generated from the TOTP shared secret for the user for the site.
10. A method operative in association with a browser having a browser plug-in executed in the browser, comprising:
detecting display by the browser of a time-based, one-time password (TOTP) authentication page associated with a site, and responsive to detecting display of the TOTP authentication page, obtaining a TOTP code, automatically injecting the TOTP code from the browser plug-in and into a fill-in field of the TOTP authentication page displayed by the browser, and automatically activating a login attempt for a user from the TOTP authentication page following injection of the TOTP code into the fill-in field to thereby complete a second step of a two-factor authentication, wherein the TOTP code is generated dynamically after detection of the TOTP authentication page by the browser plug-in executed in the browser;
wherein the browser plug-in is implemented as one of: a plug-in, an applet, an object-oriented programming control, a script, and native code.
11. The method as described in claim 10 wherein the login attempt is activated from the TOTP authentication page by programmatically clicking a submit button on the TOTP authentication page.
12. The method as described in claim 11 wherein the TOTP code is obtained following a successful completion of a mobile device push authentication interaction by the user.
13. The method as described in claim 11 wherein the TOTP code is injected by the browser plug-in into an HTML fill-in form of the TOTP authentication page.