菜单
Multi-factor authentication on mobile — TOTP, push-based MFA, and recovery UX. Use when adding or reviewing a second factor.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | mfa-on-mobile |
| description | Multi-factor authentication on mobile — TOTP, push-based MFA, and recovery UX. Use when adding or reviewing a second factor. |
MFA on mobile covers both the app as the authenticator (TOTP / push) and the app as the user (consuming a second factor during login).
| Factor | Strength | Notes |
|---|---|---|
| SMS OTP | Weak | SIM swap, SS7. Avoid unless regulation forces it. |
| Email OTP | Weak–medium | Inherits email account security. |
| TOTP (RFC 6238) | Medium | No phishing resistance on its own. |
| Push approval | Medium | Good UX; vulnerable to MFA fatigue. |
| FIDO2 / passkeys | Strong | Phishing-resistant. Prefer where available. |
fun generateTotp(secret: ByteArray, time: Long = System.currentTimeMillis()): String {
val counter = ByteBuffer.allocate(8).putLong(time / 1000 / 30).array()
val mac = Mac.getInstance("HmacSHA1").apply { init(SecretKeySpec(secret, "HmacSHA1")) }
val hash = mac.doFinal(counter)
val offset = hash.last().toInt() and 0x0f
val bin = ((hash[offset].toInt() and 0x7f) shl 24) or
((hash[offset + 1].toInt() and 0xff) shl 16) or
((hash[offset + 2].toInt() and 0xff) shl 8) or
(hash[offset + 3].toInt() and 0xff)
return "%06d".format(bin % 1_000_000)
}
Push MFA is a signing operation, not a boolean tap:
challenge_id — not an "approve / deny" payload alone.challenge_id || context_hash with a biometric-gated Keystore key.Never auto-approve. Never accept a push whose contents you didn't fetch over HTTPS from the server.
If your app is an OAuth client:
acr_values / amr claims in the id_token so the server tells you what factors were used.Recovery is where MFA projects usually fail:
ASAuthorizationController + ASAuthorizationPlatformPublicKeyCredentialProvider for passkeys.CredentialManager for passkeys / saved passwords.credential_manager package.react-native-passkey.Passkeys are strictly better than TOTP for most apps; ship them where the user base has device support.
Biometric authentication on mobile using BiometricPrompt and LAContext, with keys cryptographically gated by user biometry. Use when adding unlock, re-auth, or step-up auth flows.
OAuth 2.1 + PKCE for native mobile apps. Covers redirect URIs, AppAuth libraries, and the flows that are safe vs deprecated. Use when implementing or reviewing user login.
Handling access and refresh tokens on mobile — storage, rotation, revocation, and expiration. Use when wiring up the authenticated HTTP layer.
Anti-tampering on mobile — signature checks, runtime application self-protection (RASP), and realistic return on investment. Use to decide which integrity controls are worth shipping.
Code obfuscation on mobile — R8 / ProGuard on Android, SwiftShield and its limitations on iOS, and realistic expectations. Use when hardening release builds.
Detecting rooted Android and jailbroken iOS devices as a risk signal — not a silver bullet. Use when deciding which operations to allow on a compromised device.