security
2 posts
- TOTP as Primary Auth — Designing a Disposable Office Booking System in a Hurry A system design case study on using TOTP as the sole authentication mechanism for a short-lived internal tool: why identity providers were overkill, why unauthorized reads don't matter when the data is meant to be broadcast, and why sometimes the best architecture is the one you can ship this week.
- TOTP From Scratch — How Your 2FA Code Actually Works A deep dive into RFC 6238 Time-based One-Time Passwords: the math behind the 6-digit code, how HMAC-SHA1 produces it, and a complete Python implementation built without any TOTP library.