Tag Info

New answers tagged

1

Sending a verification code is a good option to make use of the information that you have in the database. For the type of algorithm, you can use a complex or a simple ones. The simple one that I have in mind is the timestamp and add salting to it. Like how cryptography works. As for the expiry time, make it like 3 mins would be sufficient. The number of ...


2

This is how I understand it, please correct me if I've misinterpreted something. Sending Password in the Clear A one time risk is never worth it when it can be avoided. Using a secure algorithm like bcrypt or PBKDF2 with a salt does not require the password to be sent in the clear. Even if the password is sent under TLS, am I to trust that you're not ...


1

Think about this implementation (Disclaimer: this is basic): Server displays a Random Number that changes every 30 seconds (R) Mobile device has a unique device ID (DID) Server maintains a record of authorized DIDs Both server and mobile device share a secret (S) When the mobile device wants to log in, it requests the active R from the server. The mobile ...


0

As sebastian nielsen pointed out, you should use a RADIUS server to authenticate with OTP. I disagree using a group password. If you want to distinguish users or deny access for single users one day, you should use individual authentication like OTP(RADIUS) or Client Certificates. OTP provide headache, since the OTP will not be valid a second time (as ...


1

You could configure the access point to use WPA2-Enterprise and then configure your radius server to use OTP as a password. This would mean the user enters the OTP as a password. One thing to note, is that the client does not know its a OTP and might save the profile (which will not work next time since the OTP is spent), thus causing headaches for the ...


1

For simple authentication many vendors propose this in the form of a captive portal that asks users for an OTP before allowing them access to the Internet. However, this doesn't protect the actual Wi-Fi network and if it's an open hotspot (no encryption), then users can still eavesdrop on each other's traffic unless secure protocols such as HTTPS are used. ...


0

I think this is a reasonable approach, as we have seen countless websites being hacked and millions of passwords being stolen. Using a two-factor authentication mitigates the risk. Depending on the security level of your installation, a hardware based OTP is not needed. Software-based OPT, like Google Authenticator, will suffice in most cases. You can use ...



Top 50 recent answers are included