bi-directional 2FA prototype
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Type Name Latest commit message Commit time
Failed to load latest commit information.


NSP Status


A proof of concept for bi-directional two factor authentication.

The intent of this design is to mitigate the real time phishing of two-factor authentication tokens, but more generally provide assurance that you are talking to the server you spoke to on registration.

It's called Veerless, as it doesn't let you veer off course from the genuine server.

How to try it out

  1. Download the code from follow the setup steps below.
  2. Review the code in the chrome-extension, and if you agree its non-harmful then install that. (help on how to do that)
  3. Navigate to This endpoint will give you the t0 and server_secret to add to your chrome extension, via the "options" page in the extension's settings.
  4. Now you can login at with the user that you chose. The extension will be looking for:
  • X-Veerless-Init header from the server to begin the login transaction
  • X-Veerless-Response header from the server containing its TOTP variant, that it will verify.

If it can successfully verify the header, you shouldn't see any difference to a common 2FA login experience, except that you client TOTP will be provided in a notification. If it cannot successfully verify the header, it will cancel the request, and notify you of this.

More Fiddling

You could then try and setup your own local site, attempting to spoof the live demo ; )

  • Using the code you downloaded in step 1. With the setup steps below
  • Create a line in /etc/hosts like this (which kindof simulates a dns hijack for you) veerless
  • Now try authenticate in the same way as step 4. Notice the extension should now detect that this is a spoofed site.

Site Layout

  • / - this README page.
  • /login - used to complete the login flow with veerless chrome-extension assisting.
  • /register - retrieves the initial time seed (t0) for TOTP and the server secret for a given user.

Design details


This is actually an alternate design to Veerless that doesn't require the client to provide confidentiality of the server secret, only integrity.


Update the config.js file's hostname variable to your host.

npm update
npm start

The database is self provisioning.