Tofu

Abstract

1. Introduction

Tofu generates one-time passwords to help you protect your online accounts. These passwords are used together with your normal password when you sign into services like Google, Facebook, Dropbox, Amazon, and GitHub.

Tofu works with all services that provide two-factor authentication using the HOTP and TOTP algorithms. It does not require a network or cellular connection and can be used in airplane mode.

Hey there, Calle here, the original author of Tofu Authenticator. Over the last few years I haven’t had as much time to work on the app as I had hoped for. While Tofu has been working fine (I still use the app every day), few improvements have been made and no new platform features have been integrated. Luckily, my friend Daniel Kennett who is both a long-time user of Tofu and a way more experienced iOS developer than I am, has offered to take over maintenance and ownership of the app going forward. I’m really thankful for being able to place the app in Daniel’s safe hands and look forward to following the future development of it!

2. Objective

An easy-to-use two-factor authentication app for iOS

This project demonstrates how Swift can be applied to a real-world Cybersecurity & Ethical Hacking problem.

4. Technology Stack

5. System Requirements

General requirements for this technology stack — check the README for exact versions.

• Xcode on macOS
• Git (to clone the repository)

6. Installation & Setup

git clone https://github.com/iKenndac/Tofu.git
cd Tofu

Full setup instructions are in the project README.

7. Future Enhancements

Suggested extensions you can add to make this your own project.

• Add logging and alert notifications (email / Telegram)
• Write a threat model document for the tool
• Package it with Docker for safe lab testing

8. Viva / Review Questions

Common questions examiners ask for projects in this domain.

1. Which threat or attack does this project defend against?
2. What detection or protection technique is used and what are its limits?
3. How are false positives and false negatives handled?
4. Which cryptographic algorithms or security standards are involved?
5. What legal and ethical rules apply when testing a tool like this?

9. Source Code & License

This project is developed by iKenndac and published on GitHub under the ISC License. Please follow the license terms and credit the original author when you use or modify this code.