TechPrufer
Get started
Cloudflare
Cloudflare logoCloudflare · Feature trail

Customer Support Authentication

2 posts · Feb 2017 – Apr 2020

What this trail covers

Cloudflare is enhancing customer support security by introducing Time-Based One-Time Passwords (TOTP) for phone authentication. This allows Enterprise customers to prove their identity over the phone using tokens generated from the dashboard or a 2FA app, without discussing sensitive account settings. The system uses RFC 6238 for TOTP generation, with deviations for single-use tokens and dashboard-generated codes. Future work includes callback requests and integration with other authentication methods.

All Cloudflare trails
  1. Time-Based One-Time Passwords for Phone SupportThis post details the implementation of Time-Based One-Time Passwords (TOTP) for Cloudflare's Enterprise phone support. It explains how single-use tokens are generated from the dashboard or via authenticator apps, deviating from standard TOTP by not requiring a shared secret for dashboard-generated tokens. The system hashes an internal user ID with a Cloudflare-internal secret to generate RFC 6238 compliant passwords, surfaced via JavaScript requests without exposing the secret. It also allows for validation of tokens from the previous time step to account for network delay. The APIs are wrapped with API gateways for audit logging.
  2. You can now use Google Authenticator and any TOTP app for Two-Factor AuthenticationThis post announces the integration of Google Authenticator and any TOTP app for Two-Factor Authentication. Previously, only Authy was supported. The integration uses RFC 6238 for TOTP generation and allows users to scan a barcode in the dashboard to set up their chosen TOTP app. This expands the options for users to secure their accounts with a second factor.