Two Factor Authentication

Project Overview

Two Factor Authentication (TFA) is an open-source security plugin for Joomla CMS that adds an extra layer of protection to administrator login. Developed in 2013 and distributed free of cost, it implements Google's 2-step verification using Time-based One-Time Passwords (TOTP) to secure Joomla backends.

Security Model

The plugin uses two-factor authentication requiring:

1. Something you know - Backend password
2. Something you have - Mobile phone with authenticator app

Key Features

• Google Authenticator integration - TOTP algorithm support
• Multiple authenticator apps supported (Google Authenticator, Duo Mobile, Authenticator for Windows Phone)
• Extra security layer - Protects against keyloggers, password cracking, brute force attacks
• Time-based codes - Unique verification codes generated on mobile device
• Free distribution - No subscription required
• Easy setup - Simple installation with screenshot documentation

How It Works

1. User enters username and password (first security layer)
2. System requests verification code (second security layer)
3. User generates code via Google Authenticator app on mobile
4. System validates TOTP code before granting access
5. Even if password is compromised, attacker needs physical access to mobile device

Technologies Used

• Platform: Joomla CMS
• Language: PHP
• Algorithm: Time-based One-Time Password (TOTP)
• Based on: GitHub GoogleAuthenticator.php library
• Apps Supported: Google Authenticator, Duo Mobile, Authenticator (Windows Phone), Authomator (BlackBerry)

Supported Authenticator Apps

• Google Authenticator (iPhone/Android/BlackBerry)
• Duo Mobile (iPhone/Android)
• Authenticator (Windows Phone 7 & 8)
• Authomator (BlackBerry 10)
• Any app supporting TOTP algorithm

Distribution Model

• Completely free - No cost, no subscription
• Open source - Available for free download
• Single requirement - One tweet for distribution
• Full documentation - Complete setup guide with screenshots

Security Benefits

• Protection against password cracking
• Defense against keyloggers
• Prevention of unauthorized access
• Additional layer beyond simple passwords
• Mobile-based verification - Physical device required

Project Duration

Launched: July 18, 2013
Distribution: Free with tweet
Active Period: 2013-2016

Historical Significance

Two Factor Authentication was one of Ready Bytes' early security-focused products, bringing enterprise-grade 2FA to the Joomla ecosystem at no cost. It demonstrated our commitment to improving web security and making advanced security features accessible to all Joomla users.