title: Store secret key for TOTP
body: <p>I'm looking to setup my website (C#/SQL 2008) to allow two factor authentication using Google Authenticator. I have the site working, from getting the QR code to generating the previous/current/next key (I'm happy to accept 3 in case clocks are out of sync).</p>
  
  <p>Obviously we need to generate a secret key for each user, otherwise every user would have the same one time password. </p>
  
  <p>My question is what is the <strong><em>best practice</em></strong> for storing this key? Can I store it as plain text in the users table, or should it be encrypted?</p>