MFA Implementation — Multi-Factor Authentication

MFA reduces account compromise risk by 99.9%. Implement TOTP (Google Authenticator) or WebAuthn (passkeys).

TOTP Implementation¶

import pyotp
secret = pyotp.random_base32()
totp = pyotp.TOTP(secret)
uri = totp.provisioning_uri("[email protected]", issuer_name="MyApp")
# QR code from uri → authenticator app
totp.verify(user_code, valid_window=1) # ±30s tolerance

Recovery Codes¶

import secrets
def generate_recovery_codes(count=10):
    codes = [secrets.token_hex(4) for _ in range(count)]
    # Store hashes in DB, show plaintext to user ONCE
    return codes

Recommendations¶

1. TOTP as minimum
2. WebAuthn/Passkeys as most secure
3. SMS only as fallback (SIM swap risk)
4. Recovery codes for device loss
5. Enforce MFA for admin roles

Key Takeaway¶

TOTP is minimum, passkeys are the future. SMS only as fallback. MFA for all admin accounts.