{"id":44028,"date":"2020-02-07T09:00:00","date_gmt":"2020-02-07T16:00:00","guid":{"rendered":"https:\/\/jumpcloud.com\/?p=44028"},"modified":"2022-09-08T16:07:16","modified_gmt":"2022-09-08T20:07:16","slug":"totp-mfa","status":"publish","type":"post","link":"https:\/\/jumpcloud.com\/blog\/totp-mfa","title":{"rendered":"What is TOTP MFA?"},"content":{"rendered":"\n

Organizations concerned about identity security need to make multi-factor authentication (MFA)<\/a> a standard practice for their users. MFA is one of the most effective security methods for blocking unauthorized account takeovers. There are several types of MFA<\/a>, but before we talk about TOTP MFA specifically, let\u2019s talk about MFA in general and why it\u2019s so effective at securing user accounts.\u00a0<\/p>\n\n\n\n

What is MFA?<\/h2>\n\n\n\n

MFA (also called two-factor authentication or 2FA) is the practice of requiring additional authentication factors beyond the standard username-password combination most authentication mechanisms require. <\/p>\n\n\n\n

If that credential combo is compromised for any reason, MFA acts as the final barrier between an attacker and their prize: the critical data housed within an organization\u2019s network. Since compromised credentials are the leading source of breaches<\/a>, an additional layer of security through MFA works wonders. In fact, Symantec<\/a> found that 80% of recent breaches could have been prevented with the addition of MFA.<\/p>\n\n\n\n

Because of its additional factors, MFA helps to fully authenticate that a user requesting access is who they say they are. These factors are colloquially referred to as \u201csomething you have, something you know, or something you are\u201d (e.g., an MFA token, password, or biometric information, etc.). <\/p>\n\n\n\n

Additionally, login time and location can also be used as authentication factors. In practice, each should be individualized and mutually exclusive, meaning that compromising one factor doesn\u2019t compromise the others, thus making the possibility of taking over a user\u2019s account significantly more difficult for a bad actor.<\/p>\n\n\n\n

What is TOTP MFA?<\/h2>\n\n\n\n

TOTP (Time-based, One-Time Password) is a form of MFA that uses a randomly generated code as an additional authentication token. TOTP MFA codes are generally created via a smartphone app (e.g. Google Authenticator<\/a>), so it falls under the \u201csomething you have\u201d classification. <\/p>\n\n\n\n

As the name suggests, each TOTP code is only valid for a short amount of time and constantly refreshed, meaning that the perpetrator of a breach would need both a user\u2019s compromised credentials and<\/em> direct access to their phone in order to take over their account. From a security standpoint, TOTP adds a sizable buffer between an organization and a breach.<\/p>\n\n\n\n

Regarding end user experience, however, TOTP is sometimes met with consternation. MFA already adds an extra step for users by default, and TOTP can introduce the challenge of inputting the code only for it to expire right before you submit. In comparison to other forms of MFA, however, TOTP is both fairly lightweight and effective.<\/p>\n\n\n\n

Comparing TOTP to Other Popular Forms of MFA<\/h2>\n\n\n\n

SMS-based MFA<\/h3>\n\n\n\n

SMS-based MFA uses codes similar in structure to those of TOTP, except instead of being generated directly on a smartphone, they\u2019re sent via SMS text message, which means they\u2019re being created outside of the device. Although usually generated by a trustable source, an insider attacker could potentially route the code to themselves. <\/p>\n\n\n\n

Additionally, SMS codes often last longer than TOTP codes. While this makes them easier to leverage by end users, intercepted SMS codes give a wider time frame for bad actors as well. As such, many consider SMS to be one of the least secure methods of MFA.<\/p>\n\n\n\n

Physical Key<\/h3>\n\n\n\n

Physical MFA devices<\/a> use a hardware token as the secondary authentication factor, such as a USB device. Since it requires direct possession of the authentication token, physical key MFA is considered the most secure of the available forms of MFA.<\/p>\n\n\n\n

Unfortunately, setting up unique physical keys for every member of an organization can be incredibly time consuming for already-busy IT admins. In addition, physical keys have a higher potential of becoming lost in the daily hustle and bustle, and if stolen, can spell disaster for an organization.<\/p>\n\n\n\n

Push Notification MFA<\/h3>\n\n\n\n

Probably the most convenient form of MFA available, push notification MFA<\/a> leverages a pop-up message on a user\u2019s smartphone which allows them to confirm or deny access with the push of a button. Push MFA also alerts the associated user of the time and origin of the access request, meaning they are instantly aware if another entity is attempting to breach their account.<\/p>\n\n\n\n

The main drawback of push notification MFA is the fact that organizations are required to purchase the service\/application needed to do so. TOTP-generating apps, on the other hand, are often freely available. For budget-conscious organizations, push notification MFA may not be worth the convenience compared to its effects on the bottom line.<\/p>\n\n\n\n

Biometrics<\/h3>\n\n\n\n

The most futuristic form of MFA, biometrics uses fingerprints, retinas, faces, or even voices as the additional authentication factor, and is the main \u201csomething you are\u201d form of MFA. It goes without saying that biometrics are the most personalized MFA method, making them highly secure.<\/p>\n\n\n\n

Unlike the other methods, however, biometric MFA<\/a> is the least developed of the group, meaning that implementations of it at enterprise scale are few and far between. Beyond that, there are some potential disadvantages to biometric authentication<\/a>, such as the fact that new deepfake technologies and other imitation games may provide hackers a backdoor method to a person\u2019s physical identity, allowing them into an account unhindered.<\/p>\n\n\n\n

By the Numbers<\/h3>\n\n\n\n

To wrap up this comparison of MFA forms, let\u2019s look at a recent study by Google\u2019s Security Blog<\/a> on the efficacy of popular forms of MFA:<\/p>\n\n\n

\n
\"\"<\/figure><\/div>\n\n\n

As you can see, TOTP MFA (which falls under \u201cOn-device Prompt\u201d) is incredibly effective at safeguarding accounts from the effects of an attempted hack. Armed with this knowledge, the challenge then becomes how to implement TOTP at scale.<\/p>\n\n\n\n

TOTP MFA Everywhere<\/h2>\n\n\n\n

There is a solution for organizations who need to enable MFA across all facets of their IT environment. A cloud directory service can enable TOTP MFA on systems, applications, infrastructure, and networks with just a few clicks. That\u2019s virtually all IT resources, regardless of platform, protocol, provider, or location, backed by one of the top forms of MFA.<\/p>\n\n\n\n

To learn more about TOTP MFA everywhere, consider reading how a cloud directory service can help in our Security Playbook for SaaS Startups<\/a> whitepaper.<\/p>\n","protected":false},"excerpt":{"rendered":"

There are several types of MFA, but TOTP MFA is one of the most effective. With a cloud directory service, you can enable TOTP MFA at scale.<\/p>\n","protected":false},"author":70,"featured_media":44033,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_oasis_is_in_workflow":0,"_oasis_original":0,"_oasis_task_priority":"","inline_featured_image":false,"footnotes":""},"categories":[2781],"tags":[],"collection":[2775],"platform":[],"funnel_stage":[3016],"coauthors":[2515],"acf":[],"yoast_head":"\nWhat is TOTP MFA? - JumpCloud<\/title>\n<meta name=\"description\" content=\"There are several types of MFA, but TOTP MFA is one of the most effective. With a cloud directory service, you can enable TOTP MFA at scale.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/jumpcloud.com\/blog\/totp-mfa\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"What is TOTP MFA?\" \/>\n<meta property=\"og:description\" content=\"There are several types of MFA, but TOTP MFA is one of the most effective. With a cloud directory service, you can enable TOTP MFA at scale.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/jumpcloud.com\/blog\/totp-mfa\" \/>\n<meta property=\"og:site_name\" content=\"JumpCloud\" \/>\n<meta property=\"article:published_time\" content=\"2020-02-07T16:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-09-08T20:07:16+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2020\/02\/totp-mfa.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"780\" \/>\n\t<meta property=\"og:image:height\" content=\"520\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Zach DeMeyer\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Zach DeMeyer\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/jumpcloud.com\/blog\/totp-mfa#article\",\"isPartOf\":{\"@id\":\"https:\/\/jumpcloud.com\/blog\/totp-mfa\"},\"author\":{\"name\":\"Zach DeMeyer\",\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/person\/5b2c563fb7404910e9be96e7d4e7828d\"},\"headline\":\"What is TOTP MFA?\",\"datePublished\":\"2020-02-07T16:00:00+00:00\",\"dateModified\":\"2022-09-08T20:07:16+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/jumpcloud.com\/blog\/totp-mfa\"},\"wordCount\":1009,\"publisher\":{\"@id\":\"https:\/\/jumpcloud.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/jumpcloud.com\/blog\/totp-mfa#primaryimage\"},\"thumbnailUrl\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2020\/02\/totp-mfa.jpg\",\"articleSection\":[\"How-To\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/jumpcloud.com\/blog\/totp-mfa\",\"url\":\"https:\/\/jumpcloud.com\/blog\/totp-mfa\",\"name\":\"What is TOTP MFA? - JumpCloud\",\"isPartOf\":{\"@id\":\"https:\/\/jumpcloud.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/jumpcloud.com\/blog\/totp-mfa#primaryimage\"},\"image\":{\"@id\":\"https:\/\/jumpcloud.com\/blog\/totp-mfa#primaryimage\"},\"thumbnailUrl\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2020\/02\/totp-mfa.jpg\",\"datePublished\":\"2020-02-07T16:00:00+00:00\",\"dateModified\":\"2022-09-08T20:07:16+00:00\",\"description\":\"There are several types of MFA, but TOTP MFA is one of the most effective. With a cloud directory service, you can enable TOTP MFA at scale.\",\"breadcrumb\":{\"@id\":\"https:\/\/jumpcloud.com\/blog\/totp-mfa#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/jumpcloud.com\/blog\/totp-mfa\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jumpcloud.com\/blog\/totp-mfa#primaryimage\",\"url\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2020\/02\/totp-mfa.jpg\",\"contentUrl\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2020\/02\/totp-mfa.jpg\",\"width\":780,\"height\":520},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/jumpcloud.com\/blog\/totp-mfa#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/jumpcloud.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"What is TOTP MFA?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/jumpcloud.com\/#website\",\"url\":\"https:\/\/jumpcloud.com\/\",\"name\":\"JumpCloud\",\"description\":\"Daily insights on directory services, IAM, LDAP, identity security, SSO, system management (Mac, Windows, Linux), networking, and the cloud.\",\"publisher\":{\"@id\":\"https:\/\/jumpcloud.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/jumpcloud.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/jumpcloud.com\/#organization\",\"name\":\"JumpCloud\",\"url\":\"https:\/\/jumpcloud.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png\",\"contentUrl\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png\",\"width\":598,\"height\":101,\"caption\":\"JumpCloud\"},\"image\":{\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/person\/5b2c563fb7404910e9be96e7d4e7828d\",\"name\":\"Zach DeMeyer\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/person\/image\/d1d6602d927eb5a16b1dfd4ba6b4c219\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/2145e4e676784129043e5eec7c4e41e6?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/2145e4e676784129043e5eec7c4e41e6?s=96&d=mm&r=g\",\"caption\":\"Zach DeMeyer\"},\"description\":\"Zach is a Product Marketing Specialist at JumpCloud with a degree in Mechanical Engineering from the Colorado School of Mines. He loves being on the cutting edge of new technology, and when he's not working, he enjoys all things outdoors, music, and soccer.\",\"sameAs\":[\"http:\/\/www.jumpcloud.com\"]}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"What is TOTP MFA? - JumpCloud","description":"There are several types of MFA, but TOTP MFA is one of the most effective. With a cloud directory service, you can enable TOTP MFA at scale.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/jumpcloud.com\/blog\/totp-mfa","og_locale":"en_US","og_type":"article","og_title":"What is TOTP MFA?","og_description":"There are several types of MFA, but TOTP MFA is one of the most effective. With a cloud directory service, you can enable TOTP MFA at scale.","og_url":"https:\/\/jumpcloud.com\/blog\/totp-mfa","og_site_name":"JumpCloud","article_published_time":"2020-02-07T16:00:00+00:00","article_modified_time":"2022-09-08T20:07:16+00:00","og_image":[{"width":780,"height":520,"url":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2020\/02\/totp-mfa.jpg","type":"image\/jpeg"}],"author":"Zach DeMeyer","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Zach DeMeyer","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/jumpcloud.com\/blog\/totp-mfa#article","isPartOf":{"@id":"https:\/\/jumpcloud.com\/blog\/totp-mfa"},"author":{"name":"Zach DeMeyer","@id":"https:\/\/jumpcloud.com\/#\/schema\/person\/5b2c563fb7404910e9be96e7d4e7828d"},"headline":"What is TOTP MFA?","datePublished":"2020-02-07T16:00:00+00:00","dateModified":"2022-09-08T20:07:16+00:00","mainEntityOfPage":{"@id":"https:\/\/jumpcloud.com\/blog\/totp-mfa"},"wordCount":1009,"publisher":{"@id":"https:\/\/jumpcloud.com\/#organization"},"image":{"@id":"https:\/\/jumpcloud.com\/blog\/totp-mfa#primaryimage"},"thumbnailUrl":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2020\/02\/totp-mfa.jpg","articleSection":["How-To"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/jumpcloud.com\/blog\/totp-mfa","url":"https:\/\/jumpcloud.com\/blog\/totp-mfa","name":"What is TOTP MFA? - JumpCloud","isPartOf":{"@id":"https:\/\/jumpcloud.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/jumpcloud.com\/blog\/totp-mfa#primaryimage"},"image":{"@id":"https:\/\/jumpcloud.com\/blog\/totp-mfa#primaryimage"},"thumbnailUrl":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2020\/02\/totp-mfa.jpg","datePublished":"2020-02-07T16:00:00+00:00","dateModified":"2022-09-08T20:07:16+00:00","description":"There are several types of MFA, but TOTP MFA is one of the most effective. With a cloud directory service, you can enable TOTP MFA at scale.","breadcrumb":{"@id":"https:\/\/jumpcloud.com\/blog\/totp-mfa#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/jumpcloud.com\/blog\/totp-mfa"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jumpcloud.com\/blog\/totp-mfa#primaryimage","url":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2020\/02\/totp-mfa.jpg","contentUrl":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2020\/02\/totp-mfa.jpg","width":780,"height":520},{"@type":"BreadcrumbList","@id":"https:\/\/jumpcloud.com\/blog\/totp-mfa#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/jumpcloud.com\/"},{"@type":"ListItem","position":2,"name":"What is TOTP MFA?"}]},{"@type":"WebSite","@id":"https:\/\/jumpcloud.com\/#website","url":"https:\/\/jumpcloud.com\/","name":"JumpCloud","description":"Daily insights on directory services, IAM, LDAP, identity security, SSO, system management (Mac, Windows, Linux), networking, and the cloud.","publisher":{"@id":"https:\/\/jumpcloud.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/jumpcloud.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/jumpcloud.com\/#organization","name":"JumpCloud","url":"https:\/\/jumpcloud.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/","url":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png","contentUrl":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png","width":598,"height":101,"caption":"JumpCloud"},"image":{"@id":"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/jumpcloud.com\/#\/schema\/person\/5b2c563fb7404910e9be96e7d4e7828d","name":"Zach DeMeyer","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jumpcloud.com\/#\/schema\/person\/image\/d1d6602d927eb5a16b1dfd4ba6b4c219","url":"https:\/\/secure.gravatar.com\/avatar\/2145e4e676784129043e5eec7c4e41e6?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2145e4e676784129043e5eec7c4e41e6?s=96&d=mm&r=g","caption":"Zach DeMeyer"},"description":"Zach is a Product Marketing Specialist at JumpCloud with a degree in Mechanical Engineering from the Colorado School of Mines. He loves being on the cutting edge of new technology, and when he's not working, he enjoys all things outdoors, music, and soccer.","sameAs":["http:\/\/www.jumpcloud.com"]}]}},"_links":{"self":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/posts\/44028"}],"collection":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/users\/70"}],"replies":[{"embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/comments?post=44028"}],"version-history":[{"count":2,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/posts\/44028\/revisions"}],"predecessor-version":[{"id":68699,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/posts\/44028\/revisions\/68699"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/media\/44033"}],"wp:attachment":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/media?parent=44028"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/categories?post=44028"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/tags?post=44028"},{"taxonomy":"collection","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/collection?post=44028"},{"taxonomy":"platform","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/platform?post=44028"},{"taxonomy":"funnel_stage","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/funnel_stage?post=44028"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/coauthors?post=44028"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}