I'm looking to setup my website (C#/SQL 2008) to allow two factor authentication using Google Authenticator. I have the site working, from getting the QR code to generating the previous/current/next key (I'm happy to accept 3 in case clocks are out of sync).
Obviously we need to generate a secret key for each user, otherwise every user would have the same one time password.
My question is what is the best practice for storing this key? Can I store it as plain text in the users table, or should it be encrypted?