TECHNICAL REFERENCE · NOVEMBER 2026
TOTP concepts and limitations
What happens
The server and phone share a secret established at enrolment. Both calculate short-lived codes from the secret and current time. No network call to Google or Microsoft is needed.
Authenticators
Google Authenticator and Microsoft Authenticator can both generate standard TOTP codes. The Ubuntu PAM module is named pam_google_authenticator regardless of the phone app.
Factor distinction
A sudo password plus TOTP combines knowledge and possession. An SSH private key plus TOTP combines two possession-based credentials, so it is two-step authentication rather than two different factor categories.
Threats and recovery
TOTP is phishable. Protect enrolment secrets and recovery codes, ensure time synchronisation and plan lost-phone recovery.