Question on Two Factor Authentication

[DavidBoggitt]

Hi,

A client has just asked to have two factor authentication turned on for his site.

I'm going to use the Google Authenticator, but have I understood this correctly:

1) I have to generate a secret key for each user in the backend
2) They have to remember this secret key which is just like a second password?

I'm not sure this is right....!

Many thanks,

Dave.

[andypooz]

No, two factor authentication requires people to use an external application like Google Authenticator to create a dynamic password that is time-limited. It means that every time someone logs in, they will need to use an external application or device to generate a password which they can use to log in. This password changes each time they request one, and can only be used for a limited period of time (eg. 5 minutes)
Obviously this makes things MUCH more secure.
I have been looking at this and was discussing yesterday with colleagues. Your message has reminded me to put it into action, so thank you.