"This does not, however, lead directly to the desired entrance - but to a further barrier.\n",
"This does not, however, lead directly to the desired entrance - but to a further barrier.\n",
"\n",
"\n",
"The **second login step** prevents unauthorized third parties from gaining access to your account just because they might have stolen your password.\n",
"The **second login step** prevents unauthorized third parties from gaining access to your account just because they might have stolen your password.\n",
"A quite common 2nd-factor is a **One-Time Password (OTP)** generated by a so-called **OPT-App** you installs and initializes once on one of your personal devices.\n",
"A quite common 2nd-factor is a **One-Time Password (OTP)** generated by a so-called **OTP-App** you install and initialize once on one of your personal devices.\n",
"This *OPT-app* then provides (in our case every 30 seconds) a new *one-time password* that needs to be entered on the login page.\n",
"This *OTP-app* then provides (in our case every 30 seconds) a new *one-time password* that needs to be entered on the login page.\n",
2-Factor Authentication (2FA), sometimes referred to as two-factor verification, is a security method in which you provide **two different authentication factors** to identify yourself at login.
2-Factor Authentication (2FA), sometimes referred to as two-factor verification, is a security method in which you provide **two different authentication factors** to identify yourself at login.
This process is **performed to better protect** both your credentials and the resources that you can access.
This process is **performed to better protect** both your credentials and the resources that you can access.
In the **first login step**, you start with the usual entry of a good password. The service then confirms the correctness of the password entered.
In the **first login step**, you start with the usual entry of a good password. The service then confirms the correctness of the password entered.
This does not, however, lead directly to the desired entrance - but to a further barrier.
This does not, however, lead directly to the desired entrance - but to a further barrier.
The **second login step** prevents unauthorized third parties from gaining access to your account just because they might have stolen your password.
The **second login step** prevents unauthorized third parties from gaining access to your account just because they might have stolen your password.
A quite common 2nd-factor is a **One-Time Password (OTP)** generated by a so-called **OPT-App** you installs and initializes once on one of your personal devices.
A quite common 2nd-factor is a **One-Time Password (OTP)** generated by a so-called **OTP-App** you install and initialize once on one of your personal devices.
This *OPT-app* then provides (in our case every 30 seconds) a new *one-time password* that needs to be entered on the login page.
This *OTP-app* then provides (in our case every 30 seconds) a new *one-time password* that needs to be entered on the login page.
These two factors for authentication combine the building blocks **knowledge** and **possession** in the login procedure.
These two factors for authentication combine the building blocks **knowledge** and **possession** in the login procedure.
-**knowledge** - the secret knowledge is the password you enter.
-**knowledge** - the secret knowledge is the password you enter.
-**possession** - With the *one-time password* you show that you are in possession of a certain device (e.g. your smartphone), because only the *OTP-App*, installed on that device, can generate it.
-**possession** - With the *one-time password* you show that you are in possession of a certain device (e.g. your smartphone), because only the *OTP-App*, installed on that device, can generate it.
<div style="clear:both"></div>
<div style="clear:both"></div>
<div>
<div>
<p style="float:right">Source: Bundesamt für Sicherheit in der Informationstechnik</p>
<p style="float:right">Source: Bundesamt für Sicherheit in der Informationstechnik</p>
The **OTP-App** can calculate personal one-time passwords completely autonomously from the outside world using a standardized and open algorithm for the generation of **Time-based One-Time Passwords (TOTP)**.
The **OTP-App** can calculate personal one-time passwords completely autonomously from the outside world using a standardized and open algorithm for the generation of **Time-based One-Time Passwords (TOTP)**.
The *TOTP algorithm* was published in 2011 by the [Internet Engineering Task Force (IETF)](https://www.ietf.com) as [RFC 6238](https://tools.ietf.org/html/rfc6238). The *TOTP algorithm* is a hash function in which a secret code is hashed together with the current time.
The *TOTP algorithm* was published in 2011 by the [Internet Engineering Task Force (IETF)](https://www.ietf.com) as [RFC 6238](https://tools.ietf.org/html/rfc6238). The *TOTP algorithm* is a hash function in which a secret code is hashed together with the current time.
Behind the hash function is the HMAC-based One-time Password Algorithm according to [RFC 4226](https://tools.ietf.org/html/rfc4226) - in simple terms nothing more than a standard that forms a hash in a certain way.
Behind the hash function is the HMAC-based One-time Password Algorithm according to [RFC 4226](https://tools.ietf.org/html/rfc4226) - in simple terms nothing more than a standard that forms a hash in a certain way.
The calculation includes both a **"secret initialization code"**, that is known to both the server and the client, and the **current time**.
The calculation includes both a **"secret initialization code"**, that is known to both the server and the client, and the **current time**.
The final *one-time password* is generated from these two inputs and is valid for a certain period of time. (in our case for **30 seconds**).
The final *one-time password* is generated from these two inputs and is valid for a certain period of time. (in our case for **30 seconds**).
The procedure can be implemented in such a way that slight differences in time between client and server are accepted.
The procedure can be implemented in such a way that slight differences in time between client and server are accepted.
Hence, any *one-time password* is time-based, calculated locally, and always unique.
Hence, any *one-time password* is time-based, calculated locally, and always unique.
The *TOTP algorithm* can also be implemented in hardware as a so-called "hardware token" (e.g. [Protectimus Tokens](https://www.protectimus.com/tokens/), [Microcosm Tokens](https://www.microcosm.com/products/oath-otp-authentication-tokens))
The *TOTP algorithm* can also be implemented in hardware as a so-called "hardware token" (e.g. [Protectimus Tokens](https://www.protectimus.com/tokens/), [Microcosm Tokens](https://www.microcosm.com/products/oath-otp-authentication-tokens))
Before you can use 2FA for Jupyter-JSC a random, user-specific, unique and **secret initialization code** must be known by both Jupyter-JSC and the your *OTP-App*.
Before you can use 2FA for Jupyter-JSC a random, user-specific, unique and **secret initialization code** must be known by both Jupyter-JSC and the your *OTP-App*.
This *secret initialization code* gets generated by Jupyter-JSC and is shown as a **QR-Code** (or string) on the activation page.
This *secret initialization code* gets generated by Jupyter-JSC and is shown as a **QR-Code** (or string) on the activation page.
The QR-Code provides the *secret initialization code* with the descriptive data (1) algorithm = TOTP, (2) period of validity = 30s.
The QR-Code provides the *secret initialization code* with the descriptive data (1) algorithm = TOTP, (2) period of validity = 30s.
**If you prefer to use the string** instead of the QR-Code, please ensure you set these descriptive dates manually in your *OTP-App*.
**If you prefer to use the string** instead of the QR-Code, please ensure you set these descriptive dates manually in your *OTP-App*.
Next, the *OTP-App* provides now a **verification code** you have to enter on the activation webpage.
Next, the *OTP-App* provides now a **verification code** you have to enter on the activation webpage.
Jupyter-JSC compares the *verification code* you provide with the one generated by Jupyter-JSC.
Jupyter-JSC compares the *verification code* you provide with the one generated by Jupyter-JSC.
