Tag Info

New answers tagged

2

Authentication relies on the following: (source) Something you know Something you have Something you are A good reason to use TOTP is to increase security by using multiple factors from the list above. For example, if your password becomes known to someone else, they would still need access to your TOTP device to authenticate. However, that does not ...


2

Many OTP systems allow you to receive an OTP by SMS/email. So the system has to know when to send you an OTP. You might suggest that there could just be a "request OTP" button next to the form. But then anyone can repeatedly click on the button, meaning that you will receive a huge amount of spam email/SMS. You might suggest fixing that issue by limiting ...


3

Use a Session Cookie to track users throughout the authentication process, just as you would after authentication. Make sure that your cookie's length and complexity are sufficient to withstand brute-force and spoofing attacks. Use the secure and httponly attributes to prevent the bad guys from capturing and using it. Use one cookie for ...


2

You should have session cookies. Most web frameworks have useful support for that. But from a security viewpoint, there is an important issue. Using session cookies (to differentiate the browsers using your site) and login credentials (to differentiate the users of your site) effectively doubles the authentication functionality of your system. Thus a new ...


1

I would use an unprivileged session token between the two steps, that only proves that this user has finished the first part of your multi-stage authentication processes, but that leaves him unauthenticated (unprivileged). Then, after the completion of the second-stage, regenerate a session token and escalate the user's privileges to "authenticated" (or ...



Top 50 recent answers are included