# For times when you need to keep things from your users

**URL:** <https://forum.inductiveautomation.com/t/for-times-when-you-need-to-keep-things-from-your-users/15738>\
**Category:** General Discussion\
**Created:** [October 21, 2017, 2:24am UTC](https://forum.inductiveautomation.com/t/for-times-when-you-need-to-keep-things-from-your-users/15738 "2017-10-21T02:24:29Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![cmisztur2](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/cmisztur2/32/4243_2.png) [@cmisztur2](https://forum.inductiveautomation.com/u/cmisztur2)\
**Post date:** [October 21, 2017, 2:24am UTC](https://forum.inductiveautomation.com/t/for-times-when-you-need-to-keep-things-from-your-users/15738/1 "2017-10-21T02:24:29Z")

</div>

(1.5FA) time-based almost-one-time password algorithm… 😁

 ![](https://us1.discourse-cdn.com/inductiveautomation/original/2X/2/230b87ee1d9ecc2c17f117c01f781f1c6772ebbe.png)

```auto
def oneTimeAuthorize():
	resultString = system.net.httpGet("https://api.coindesk.com/v1/bpi/currentprice.json")
	resultPy = system.util.jsonDecode(resultString)
	btcpi = int(resultPy['bpi']['USD']['rate_float'])
	answer = system.gui.passwordBox("COINDESK BTC PI","Enter Password",'$')
	try: 
		if int(float(answer))==btcpi: 
			return True
		else:
			return False 
	except:
		return False

```

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [October 21, 2017, 2:16pm UTC](https://forum.inductiveautomation.com/t/for-times-when-you-need-to-keep-things-from-your-users/15738/2 "2017-10-21T14:16:47Z")

</div>

> [@](#):
>
> ...keep things from your users

You know this forum is public, right? 😉

---

<div class="post-metadata">

**Author:** ![cmisztur2](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/cmisztur2/32/4243_2.png) [@cmisztur2](https://forum.inductiveautomation.com/u/cmisztur2)\
**Post date:** [October 21, 2017, 4:23pm UTC](https://forum.inductiveautomation.com/t/for-times-when-you-need-to-keep-things-from-your-users/15738/3 "2017-10-21T16:23:04Z")

</div>

… and the user that finds this I will train in Ignition.

---

<div class="post-metadata">

**Author:** ![Kyle\_Chase](https://avatars.discourse-cdn.com/v4/letter/k/9de0a6/32.png) [@Kyle\_Chase](https://forum.inductiveautomation.com/u/Kyle_Chase)\
**Post date:** [October 22, 2017, 7:06pm UTC](https://forum.inductiveautomation.com/t/for-times-when-you-need-to-keep-things-from-your-users/15738/4 "2017-10-22T19:06:29Z")

</div>

Why not just use a real TOTP authenticator, based on RFC 6238? Here is an example window.

Note, if you want this in production, the authenticator secrets need to be persisted per user, and the code will have to change a bit (There is no need for the Authenticator class to hold onto any keys, they get fed in during the check\_code method).

If you have any questions let me know.  
[prime\_totp\_2017-10-22\_1902.proj](https://us1.discourse-cdn.com/inductiveautomation/original/2X/1/17e1cac4cd520f9a65f4ebc6717dfd567c1feb35.proj) (13.7 KB)

---

<div class="post-metadata">

**Author:** ![cmisztur2](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/cmisztur2/32/4243_2.png) [@cmisztur2](https://forum.inductiveautomation.com/u/cmisztur2)\
**Post date:** [October 22, 2017, 10:45pm UTC](https://forum.inductiveautomation.com/t/for-times-when-you-need-to-keep-things-from-your-users/15738/5 "2017-10-22T22:45:46Z")

</div>

Thank Kyle, that’s very helpful.