<p>With Google Authenticator, you scan a barcode into your phone and it generates a temporary 6-digit key every minute, regardless of whether the app is open or not. It is not limited to one person, just to one account. These codes rely on times being in sync so that when an authenticator code expires, it expires on the site as well. Most use two protocols - HOTP and TOTP.</p>

<p>Highlights from this answer: <a href="https://security.stackexchange.com/a/35159">https://security.stackexchange.com/a/35159</a></p>

<p>HOTP = Client and server share a counter, when code generated, timer increments, producing a new one-time login code.</p>

<p>TOTP = HOTP except the counter is replaced by the current time. So long as the system times are in sync, both the client and the server will be on the same page as far as what 2FA code is currently the correct one.</p>

<p>If multiple people scan this barcode, they will all generate the same keys. Thus, all you need to do is have both people present when setting up two-step authentication (or save the barcode if they have incompatible schedules, but be sure to shred it later), and they will both be able to access the account whenever they want.</p>

<p>Due to best OpSec practices, it is best to have separate 2FA keys, or use an alternative method, such as key-pair authentication where each user has their own key to access the server. This is better for auditing purposes where you can determine more easily the difference between different users, especially if one user decides to do something malicious using a shared authentication code.</p>

CC BY-SA 4.0
2019-12-24T13:50:33.273Z
@SentientFlesh I think your edit should have been a separate answer. I'm leaving it before this comment because it adds good information, but that information isn't always usable by website clients, depending on what the security policies actually are.
Daniel H
CC BY-SA 3.0
2012-08-28T18:13:49.480Z
Oh, of course -- with Google Authenticator I can copy the QR code (e.g., screen shot if  necessary) and then share that (in a secure manner) with each party that needs access.
Stephen Gornick
CC BY-SA 4.0
2012-08-28T05:55:00.513Z
2019-12-24T08:53:34.333Z
2019-12-24T08:53:34.333Z
Daniel H
<p>With Mt.Gox you can add multiple authenticators; while I'm not sure if you can add two copies of the same type of authenticator, it is worth a try.</p>

CC BY-SA 3.0
2012-08-28T11:28:55.667Z
2012-08-28T11:28:55.667Z
o0'.
<p>For a business account at a Bitcoin exchange, either of two people need to be able to send bitcoins or withdraw.  This account will be configured with two-factor authentication.</p>

<p>How can two of the business' staff, located in different offices, each have access to the account?</p>

<p>The exchange specifically will be with BitFloor using Google Authenticator OTP, but the same question would apply for using Mt. Gox, with Yubikey, for instance.</p>

CC BY-SA 3.0
2012-08-28T18:16:01.303Z
Apparently with YubiKey, the exchange needs to accommodate multiple OTP authentication devices.

It looks like the only exchange to support multiple simultaneous Yubikey authenticators is Mt. Gox.  

The private key for Google Authenticator can be replicated so that doesn't have this restriction, as Daniel H answered below.
Stephen Gornick
<security><exchanges><authentication><two-factor><multi-factor>
How can multifactor authentication be used when there needs to be two people with access?
Stephen Gornick
# How can multifactor authentication be used when there needs to be two people with access?

(Asked by: username_0 on 2012-07-18)

For a business account at a Bitcoin exchange, either of two people need to be able to send bitcoins or withdraw. This account will be configured with two-factor authentication.

How can two of the business' staff, located in different offices, each have access to the account?

The exchange specifically will be with BitFloor using Google Authenticator OTP, but the same question would apply for using Mt. Gox, with Yubikey, for instance.

**Tags:** security, exchanges, authentication, two-factor, multi-factor

> **Comments:**
> **username_0**: Apparently with YubiKey, the exchange needs to accommodate multiple OTP authentication devices.  It looks like the only exchange to support multiple simultaneous Yubikey authenticators is Mt. Gox.    The private key for Google Authenticator can be replicated so that doesn't have this restriction, as username_1 H answered below.  

---

## 2 answers

### Answer by username_1 on 2012-08-28. Score: 2 | Accepted answer

With Google Authenticator, you scan a barcode into your phone and it generates a temporary 6-digit key every minute, regardless of whether the app is open or not. It is not limited to one person, just to one account. These codes rely on times being in sync so that when an authenticator code expires, it expires on the site as well. Most use two protocols - HOTP and TOTP.

Highlights from this answer: <https://security.stackexchange.com/a/35159>

HOTP = Client and server share a counter, when code generated, timer increments, producing a new one-time login code.

TOTP = HOTP except the counter is replaced by the current time. So long as the system times are in sync, both the client and the server will be on the same page as far as what 2FA code is currently the correct one.

If multiple people scan this barcode, they will all generate the same keys. Thus, all you need to do is have both people present when setting up two-step authentication (or save the barcode if they have incompatible schedules, but be sure to shred it later), and they will both be able to access the account whenever they want.

Due to best OpSec practices, it is best to have separate 2FA keys, or use an alternative method, such as key-pair authentication where each user has their own key to access the server. This is better for auditing purposes where you can determine more easily the difference between different users, especially if one user decides to do something malicious using a shared authentication code.

> **Comments:**
> **username_0**: Oh, of course -- with Google Authenticator I can copy the QR code (e.g., screen shot if  necessary) and then share that (in a secure manner) with each party that needs access.  
> **username_1**: @SentientFlesh I think your edit should have been a separate answer. I'm leaving it before this comment because it adds good information, but that information isn't always usable by website clients, depending on what the security policies actually are.  

---

### Answer by username_2 on 2012-08-28. Score: 0

With Mt.Gox you can add multiple authenticators; while I'm not sure if you can add two copies of the same type of authenticator, it is worth a try.


---

