0

Would 2FA (let's say FreeOTP) work on Tor given the demands for privacy? Can I implement a 2FA solution on a onion website without giving away the servers location in any way along with the users on that website being able to use 2FA to access their accounts while at the same time nobody can discover where they are located?

As far I undertand you can run the authenticator from your phone without being connected to the internet however is there something that could compromise the servers or clients location if the server was seized?

I am basically looking for an anonymous 2FA solution that won't leak anyones location. Any help much appreciated.

Improve this question

2 Answers 2

Reset to default
0

2FA in general has nothing to do with physical location. Some like HOTP may require you to store information about how to contact the user to send the code (such as an email address), but others like TOTP depends only on a shared secret and the current time (you can see the general requirements here). Authenticator apps (like those used for TOTP) have no need to access the network, but some do for additional features (such as Authy, which can backup the TOTP secrets in the cloud). TOTP-based 2FA seems like the simplest 2FA solution for onion services.

Of course, requiring 2FA means that the user is only pseudo-anonymous. The server will be able to track each time that same user authenticates, across every session.

Improve this answer
4
  • Could you please elaborate on the last paragraph. What exactly will the server see each time the user authenticates? Can the server see the users IP or any location info?
    – user32281
    Apr 30, 2021 at 3:16
  • The server will only see the information that the user provides, so typically their username and password.
    – Steve
    Apr 30, 2021 at 3:59
  • I understand that no access to the internet is required but what about at the point of making your username and password? is this only done locally without needing access online? Couldn't an adversary find out what IP you used to set this username up?
    – user32281
    Apr 30, 2021 at 13:26
  • I'm not sure that I understand. 2FA is something you use on top of an existing authentication mechanism (such as a username and password), so the user can just create an account over Tor like they normally would without 2FA.
    – Steve
    Apr 30, 2021 at 16:24
0

You're understanding things right: using 2FA has nothing to do with your server location, so just use it as you would do it on the regular website - there's no difference at all because all you basically need is a QR code for an authentication profile and the authenticator does not care about how exactly it's delivered. The only case that will have it's difference is a SQRL 2FA, but as I see your question - it's totally not your case. So just install the QR code generator and 2FA on your website and be safe!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .