Thanks for watching TechWiki. Click the subscribe button, then enable notifications with the bell icon so you won't miss any future videos.
So you're going about your day when you get an alarming sounding email telling you that some miscreant has gotten into one of your accounts
and they might be rifling through your embarrassing personal files at this very moment.
Oh, if only you'd enabled two-factor authentication like we urged you to in this video here.
So you frantically change your password, set up two-factor so you'll get login codes on your smartphone,
and after a short period of relief when you realize it was just a throwaway account you used for online dating back when you were single,
you get to wondering, how exactly does that code generator app sync up with the service that you're trying to log into?
And does it work without an internet or cell connection?
Well, as it turns out, generating a new string of numbers to punch in,
every 30 seconds or so, doesn't require continuous communication with a server somewhere after initial setup.
Although there are a number of services that do simply send codes over email or SMS without using their own apps,
code generators are becoming more and more popular since they can even work when you're on a plane with no SMS reception.
You see, these code generators are based on time.
Whenever you're setting up two-factor authentication for a new account,
the service will randomly generate a short string of characters or a key, which it will send to your phone.
You commonly see this as a QR code, which your authenticator app can scan using your phone's camera.
At this point, your authenticator app will start generating these codes by taking the current time and using the specific key the server assigned to it
to run that time value through a cryptographic hash.
Turning it into a totally different number.
Which number the hash function spits out will depend on your unique key, and since that key is tied to your device,
the only practical way to get the service to validate a login attempt is to have it physically.
Now typically, this hash function will give you a new code every 30 seconds,
invalidating the old one shortly afterward. This makes life very difficult for would-be attackers.
Unless a hacker could steal a code with a keylogger or something and enter it, along with a valid password, in a matter of seconds,
any code that they steal would be about as worthless as front-row tickets to last night's big game.
This half a minute window also gives your phone a bit of buffer in case its clock isn't exactly synced up with the server,
because it's much more likely that your phone's time is within 30 seconds of a server than within a hundredth of a second.
And since all your phone needs to know is the current time and the secret key,
your phone can be missing a SIM card, have a broken Wi-Fi transponder, or even a cracked screen,
but it can still give you valid codes.
Cool.
And because this implementation is quite simple, free apps like Google Authenticator and Authy can support loads of different websites,
meaning that you don't need a dedicated app littering your home screen for every service that you use.
Of course, this convenience doesn't mean that it's perfect.
Your phone could suffer a battery problem that could mess up its clock,
the encryption could be broken by brute force,
or an attacker could just get really lucky and guess your six-digit code,
which, winning the Powerball is far less likely, and that worked for Judy F. from Clifton.
I gotta go buy some lottery tickets!
Bye!
This video is brought to you by Cheddar.
Over on Cheddar's YouTube channel,
they've got a variety of different segments,
covering a wide variety of topics.
One segment is called Cheddar Explains,
where they take a particular topic and, well, they explain it.
So you can check out Cheddar's video on robotic, exotic dancers,
not kidding,
through the link below,
where they take a look at how jobs for actual humans,
including pole dancing,
may be impacted in the future by robots that are designed for companionship.
So thanks for watching, guys!
Like, dislike,
check out our other channels,
and don't forget to subscribe!
If you like our channels, leave a comment with video suggestions and subscribe!
Subscribe!