Currently building authentication for a mobile app, and the flow goes as follows: User inputs phone # > User receives TOTP SMS > User inputs TOTP > User is logged in Would you store TOTP in DB or in memory (ETS or GenServer)?

Database. It lets you run multiple versions of your app easily, and if your app goes offline, that doesn’t nuke people’s code. GenServers / ets are a great way to store ephemeral state or cache values. TOTP codes are short lived but not ephemeral.

That answer was FAST man :hot_face: [image] benwilson512: It lets you run multiple versions of your app easily, and if your app goes offline, that doesn’t nuke people’s code. Makes sense, follow up question, would you have a separate table for them, or just stick them in the account/user tab…

[image] WestKeys: [image] benwilson512: short lived but not ephemeral. What’s the difference ? It means that if you store them in memory and your server goes off or restarts before the user receives the TOPT and inputs it, then the application will not recognize the valid TOPT and the …

[image] WestKeys: would you have a separate table for them, or just stick them in the account/user table ? Definitely a separate table. You want to track individual issuances of these codes.

[image] benwilson512: You want to track individual issuances of these codes For what purpose ? I naively assumed that even though they would be in a separate table, that they should be cleaned up after verification. Hmm on second thought, attempt limiting I guess?

Yeah it’s worth cleaning them out eventually but we like to keep them around for customer support and security purposes for a bit. If someone is having issues it’s easier to help if you can see all of their attempts.

Why store individual TOTPs at all? " Time-based" in TOTP mean that knowing shared secret you can always generate all past and future tokens, so storing them is pointless. @WestKeys probably meant OTP not specifically TOTP. TOTP do not need to be stored at all (except the shared secret).

Yes you’re right. Naively assumed OTP’s with an expiry == TOTP.

I would highly suggest “real TOTP” instead of SMS based 2FA, as the latter can work even with offline devices. It is also much easier and cheaper to implement.

I have not used it personally but you should check out NimbleTOTP v1.0.0 — Documentation , it seems as though they have implemented most of what you need already. Just store the secret after the user has confirmed it and then you can get codes from an authenticator app or text them to a user yourself…