Info |
---|
ECMWF plans to retire the ActivIdentity (HID) Security Tokens that have been used to provide a two-factor (strong) authentication access to ECMWF systems since 2007, and replace these with a TOTP (Time-based One-Time Password) Client application. This page describes how to activate TOTP for your ECMWF User and documents the current status of services that have been configured to use TOTP The page was last updated on . |
Table of Content Zone | |
---|---|
|
Background
The ActivIdentity (HID) security token has been used for over a decade at ECMWF, replacing similar RSA tokens which were used before. These tokens provide a second factor for user authentication alongside a user's password, enabling strong authentication for security sensitive services such as login access to ECMWF's Unix systems.
ECMWF plans to replace the ActivIdentity tokens with a Time-Based One Time Password authenticator application, more accurately known as TOTP Clients ("time-based one time password"). Typically, the TOTP clients are implemented on a smartphone. The Client is synchronised with systems at ECMWF by the user visiting a web page themselves. Clients usually use PIN codes, or biometric features, for protection.
In the case of a TOTP Client implemented on a smartphone, after the initial synchronisation, the second factor number is displayed in the application and automatically changes every 30 seconds.
TOTP Clients have the following beneficial properties:
- Users are free to choose the TOTP Client they use, as this is a widely used open standard for second factor authentication.
- Management is self-service for the user through the use of QR Codes (3D barcodes) to establish synchronisation with ECMWF's systems.
Info |
---|
All Bologna systems will accept both ActivIdentity and TOTP Clients as a second factor, in parallel, until 31st March 2023, at which point the ActivIdentity HID systems will be switched off. |
Tip |
---|
A smartphone is not required to use TOTP; see the question "Is a smartphone required for the TOTP Client?" below. |
Features of TOTP implemented at ECMWF
- You can have as many TOTP devices configured as you like. Either you have several different authenticator apps installed on your mobile phone, or you can use several different mobile phones.
- Command line tools such as oathtool provide a command line TOTP app that can be used from a workstation or laptop
- You can delete your own configured TOTP. If you all your configured TOTP devices, then the behaviour reverts back to the current one (i.e. use of ActivIdentity HID security token)
- If you cannot login at all because of TOTP, open a Software and computing ticket in the ECMWF Support Portal to request deletion of the wrong TOTP profile .
Tip | ||
---|---|---|
| ||
Users should ensure access to the TOTP client is protected if their device were to be lost, stolen, shared or otherwise compromised. On a mobile device this can be achieved, for example, with a PIN, Password or Fingerprint lock on the device. Many TOTP client applications also support additional authentication to the application itself (this can provide additional protection, especially if the device is shared). Ensure you keep the device up to date and we strongly recommend not rooting or jailbreaking your device because this weakens the protections built into it. |
Using TOTP for access to ECMWF services
Below you will find some basic information about the TOTP service at ECMWF and how to use it.
TOTP: How to activate
Multiexcerpt include | ||||
---|---|---|---|---|
|
TOTP: How to use
Multiexcerpt include | ||||
---|---|---|---|---|
|
TOTP: Using oathtool to provide a one-time-password
Multiexcerpt include | ||||
---|---|---|---|---|
|
Status of services using TOTP at ECMWF
Multiexcerpt include | ||||
---|---|---|---|---|
|
Show If | ||||||
---|---|---|---|---|---|---|
| ||||||
Status of services using TOTP and accessible to ECMWF staff only
|
Questions and Answers
Anchor | ||||
---|---|---|---|---|
|
No.
It is possible to use a command line application such as oathtool
in just the same way.
Alternatively there are suppliers of hardware TOTP Clients (FEITIAN OTP c200 OATH, Thales eToken PASS, OneSpan Digipass GO) although they typically require a PC or phone for initial setup and synchronisation. While ECMWF will not cover the cost of such solutions, any user of ECMWF services is welcome to use them.
Which TOTP Client application should be used on my smartphone?
There are many to choose from, and they all provide the same basic features. Examples include:
- Google Authenticator
- Microsoft Authenticator
- LastPass Authenticator
- Red Hat FreeOTP
You may wish to find one with a cloud backup, so that the synchronisation is backed up in case you lose your smartphone.
ECMWF commits to finding and offering a working solution to any user, but does not commit to making all TOTP applications work. In other words, users are supported in their use of TOTP applications in the same way that standards-compliant web browsers are supported when accessing web services.
Is TOTP less secure than the HID ActivID Personal Token?
No.
The HID Personal Token combines a time-based one-time password (a number) with the protection of a PIN code.
The TOTP Client is just the same but replaces the PIN code with your smartphone device lock (biometric or PIN).
If purchasing a hardware TOTP Client, ECMWF naturally recommends one with a PIN code for protection.
Does ECMWF gather any information from my smartphone when I use it for TOTP ?
ECMWF only stores the seed key and a device “friendly name” provided by the user. No information is gathered from the smartphone.