Overview
To enhance account security, ID Check application supports Multi Factor Authentication (MFA) using a Time-based One-Time Password (TOTP). This works in conjunction with an Authenticator App (such as Google Authenticator, Microsoft Authenticator, or Authy).
Setup Process
MFA setup is triggered during the following events:
After successful user registration
During a login if MFA is not yet set up
Step-by-Step
QR Code Generation
During the registration completion step or at login, the app generates a QR code. This QR code encodes a secret key in the standard TOTP URI format.
Scan with Authenticator App
The user is prompted to scan the QR code using their preferred Authenticator App. This sets up the TOTP generator for their account.
Verify TOTP
After scanning, the user is asked to enter a 6-digit code generated by the Authenticator App. If the code is valid, MFA setup is marked as complete.
Save This Device (optional)
The user can choose to "Save This Device" during the TOTP prompt. If selected, the device will be trusted and the user will not be prompted for TOTP again for 12 hours. After
12 hours, MFA will be triggered again on the same device.
Login with MFA
Once MFA is set up:
Username and Password
The user logs in with their credentials as usual.
TOTP Prompt
Upon successful password authentication, the system prompts the user for a TOTP code.
Code Verification
The entered code is verified against the server-generated value. If valid, the user is granted access.
Save This Device (optional)
The user can choose to "Save This Device" during the TOTP prompt. If selected, the device will be trusted and the user will not be prompted for TOTP again for 12 hours. After
12 hours, MFA will be triggered again on the same device.
Notes :
TOTP codes are valid for a short duration (typically 30 seconds).
If the user loses access to their Authenticator App, they will need to contact support for account recovery.
The QR code is generated based on a shared secret, which should be stored securely.