Secure application development · University capstone prototype

TOTP Multi-Factor Authentication

A local Flask prototype for password and TOTP authentication.

A Flask authentication prototype implementing bcrypt password hashing, time-based one-time passwords, account lockout and authentication event logging, evaluated through controlled tests.

My contribution: Developed and evaluated Flask-based authentication
Evidence / output: Password/TOTP flow with controlled evaluation and regression tests
Scope: University prototype; not production

View GitHub repository Supporting documentation

PythonFlaskSQLitebcryptPyOTPAuthentication

Repository updated 30 Oct 2026 · Snapshot checked 6 Nov 2026 (UTC)

08Manual evaluation checks

08Later regression tests

02Authentication factors

01 / CONTEXT

Project context

Passwords alone are vulnerable to credential reuse and compromise. The capstone explored how a second authentication step can strengthen login security while creating its own operational and threat-model limitations.

02 / EXECUTION

What I did

Designed local account registration with bcrypt password hashing and TOTP enrollment.
Implemented the password-verification and one-time-code flow with failed-login lockout and event logging.
Evaluated expected behavior using eight controlled manual functional and security checks.
Documented threats and limitations including TOTP phishing relay, replay handling, secret storage, CSRF and deployment hardening needs.

SYSTEM FLOW

Local authentication prototype flow

01Login requestAccount identifier and password supplied locally
02Password verificationFlask application checks bcrypt hash
03Second factorPyOTP time-based one-time code verification
04Application accessLocal session flow and authentication event logging

Simplified application flow reflecting the university prototype; not a deployed identity service.

03 / VERIFICATION

Evidence and outcomes

Source code, architecture, threat model and evaluation are available in the repository.
Follow-up regression tests are clearly differentiated from original university assessment work.
Known prototype limitations are documented rather than concealed.

Direct evidence and documentation

Full documentation and source files are in the public GitHub repository.

DOCUMENTED EVIDENCE

Evidence gallery

Selected source-backed examples from the linked repositories. Images are published from already-sanitized source files; report excerpts remain explicitly labelled.

REPOSITORY REPORT EXCERPT

Original capstone evaluation

8/8 reported local manual checks

Source evaluation distinguishes the historical report's controlled tests from later portfolio regression tests; no current production assurance is implied.

View original repository evidence

REPOSITORY REPORT EXCERPT

Authentication boundary

Password verified → pending MFA → TOTP verified

The architecture document distinguishes a pending second factor from an authenticated session and records known phishing, replay and deployment limitations.

View original repository evidence

TECHNICAL NOTE

What a TOTP second factor adds—and what it does not

Does a password plus one-time code make a login phishing-resistant?

Method: The local Flask prototype separates password verification and TOTP verification, hashes passwords with bcrypt and records authentication outcomes.
Observed / documented: Controlled tests documented rejection of invalid codes and prevention of password-only authenticated access.
Limits of the evidence: The prototype does not establish resistance to real-time phishing relay or every replay and lockout abuse scenario; stored TOTP secrets remain sensitive.

Read the authentication threat model

04 / LIMITATIONS

Limitations

Scope

Educational localhost prototype, not production-ready. The formal university degree award is still pending.

Next project / 05