(I've studied two-factor authentication using HOTP and TOTP, and built a node.js implementation of it.)
The QR codes simply divulge a URI with the secret key for generating tokens. They look like:
otpauth://totp/[keyname]?secret=[secretkey]
The secret key is used in the app in conjunction with a moving factor (usually 30-second intervals of time) to generate a numerical hash of sorts for that interval of time, which is then truncated to 6 characters.
The QR code itself doesn't have any sort of time limit on them; they only serve to transmit the secret key.
Technically, yes. The name of the key is set by default as the account name in the app. I haven't looked into how the secret is stored in the Google Authenticator app—hopefully it's stored securely or with some level of obfuscation, but the app definitely needs to be able to retrieve the secret key somehow to do the token calculation.
One thing to note is that neither Google Authenticator nor Duo Security let you display the secret itself in the app. Another thing to note is that Google Authenticator keys seem to be backed up if you back up your iPhone to a computer using iTunes (mine were still there after a restore).
fine, outdo me haha. Saving the Key is useful with AWS MFA because if some reason you loose your MFA Virtual Key (app updates and you loose the key) you have to contact AWS to have it reset, Can't just do it yourself.
The QR codes simply divulge a URI with the secret key for generating tokens. They look like:
The secret key is used in the app in conjunction with a moving factor (usually 30-second intervals of time) to generate a numerical hash of sorts for that interval of time, which is then truncated to 6 characters.The QR code itself doesn't have any sort of time limit on them; they only serve to transmit the secret key.