On the Liip blog there's a recent post talking about a tool Google offers to help you authenticate your users, a one-time passcode generator called Google Authenticator. The post talks about a PHP port of the same idea.

The main point about 2-step verification is that something else than your computer provides that token. If it's on your computer and that one gets stolen (or hacked into), it won't help much for the additional security. That's why you need a second device for those tokens. Some banks do that with SMS/Text Messages (Facebook, too), other give you special devices for that (eg. RSA keys) and the last group does it with your smartphone.

At the request of a client, they created a tool that did just this, but for PHP. As a result, they created the GoogleAuthenticator library that makes it easy to implement in your application. There's even an example of it in use. For more information about the Google Authenticator tool, see this page on Google Code.

In a new post on the Splitbrain blog today about creating and working with Semacode and QR Codes, specifically with PHP functionality.

I was more interested in Semacode, because it looks somehow cooler than QR in my opinion. Unfortunately I wasn't able to find any free (beer and speech) PHP library to create these codes.

He did, however, find a Javascript port (from a C library) to harvest the logic from and create his own PHP class to handle the semacode creation. He notes that it's probably still a bit buggy but is offering it for download to whoever might want to mess around with it.