0

Would 2FA (let's say FreeOTP) work on Tor given the demands for privacy? Can I implement a 2FA solution on a onion website without giving away the servers location in any way along with the users on that website being able to use 2FA to access their accounts while at the same time nobody can discover where they are located?

As far I undertand you can run the authenticator from your phone without being connected to the internet however is there something that could compromise the servers or clients location if the server was seized?

I am basically looking for an anonymous 2FA solution that won't leak anyones location. Any help much appreciated.

0

2FA in general has nothing to do with physical location. Some like HOTP may require you to store information about how to contact the user to send the code (such as an email address), but others like TOTP depends only on a shared secret and the current time (you can see the general requirements here). Authenticator apps (like those used for TOTP) have no need to access the network, but some do for additional features (such as Authy, which can backup the TOTP secrets in the cloud). TOTP-based 2FA seems like the simplest 2FA solution for onion services.

Of course, requiring 2FA means that the user is only pseudo-anonymous. The server will be able to track each time that same user authenticates, across every session.

4
  • Could you please elaborate on the last paragraph. What exactly will the server see each time the user authenticates? Can the server see the users IP or any location info?
    – user32281
    Apr 30 at 3:16
  • The server will only see the information that the user provides, so typically their username and password.
    – Steve
    Apr 30 at 3:59
  • I understand that no access to the internet is required but what about at the point of making your username and password? is this only done locally without needing access online? Couldn't an adversary find out what IP you used to set this username up?
    – user32281
    Apr 30 at 13:26
  • I'm not sure that I understand. 2FA is something you use on top of an existing authentication mechanism (such as a username and password), so the user can just create an account over Tor like they normally would without 2FA.
    – Steve
    Apr 30 at 16:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.