The encyclopedia · Software & IT · Product decision · 2010–2011
Google's free Authenticator made time-based one-time codes the 2FA standard
RFC 6238 plus a free Google app let any service add two-factor authentication without proprietary hardware.
the move
By 2010, stolen passwords were the default way into accounts, and hardware token systems were expensive and proprietary. The industry group OATH developed a time-based one-time password algorithm so a code could be derived from the current time and a shared secret.
The design meant the server never had to track state: both sides run HMAC on the same time step, so a phone and a website agree on a fresh code every 30 seconds. The IETF published the result as RFC 6238 in May 2011, an open standard anyone could implement.
Google then shipped Google Authenticator as a free app that anyone could enroll codes into by scanning a QR code. Any service could adopt the same open standard, and two-factor authentication became a checkbox rather than a hardware purchase, spreading across banks, social networks and developer tools.
why it works
- Time replaces counters, so server and phone stay in sync without state
- An open RFC meant no vendor owned the format
- Google's free app removed the hardware barrier to adoption
- A stolen password alone stopped being enough to break in
what transfers
Ship the free implementation alongside the open standard, and the standard adopts itself — no sales force required.
what came after
TOTP became the default second factor for millions of services and is built into password managers and platform authenticators. Phishing-resistant WebAuthn passkeys have since begun to supersede it, but TOTP remains the baseline two-factor standard.
references
spotted an error? The archive wants to know.