New answers tagged

0

I agree with Aron's answer but will add that having the OTP codes in the password manager defeats the spirit of multi-factor authentication which is to supplement something you know-- a password-- with something you have-- usually your phone. Using 2FA to access the password manager may be sufficient protection, but be clear that when you store the OTP ...


1

[Note: This question has been re-posted on crypto.SE.] Let's break down the problem into two parts: The first problem is that you want something that looks random to an outside attacker (ie is unpredictable), but can be computed by anybody in the know. That sounds a lot like a Cryptographically secure pseudorandom number generator (CPRNG) where all nodes ...


2

There isn't an industry standard on this that I'm aware of. It's up to your implementation and expected desyncronization. A single minute may still have synchronization problems. If you set it to 5 minutes (in each direction) that's a total of 20 valid OTPs at any given time (assuming a 30 second expiration). This means that a guess would have a 1 in 50000 ...


2

A one-time pad is an encryption mechanism consisting of combining a stream of key material with the data to encrypt, using a reversible operation; this combination can be very simple, and even doable by hand (without a computer), and still retain security as long as the key material (the "pad") is as long as the data to encrypt, and is never reused (that's ...


1

Sorry, but no. The OTP needs really really random numbers. Like, /dev/random random or better (see this). If your random number generator has "pseudo" anywhere in its name, OTP won't work. If you want to use pseudo-random numbers to transmit a message, lookup Block cipher. The thing to keep in mind with OTP is that if a stream is even partially truly ...


2

Well, it is two-factor, so it does add some security. It's not great two factor, for a couple of reasons. The user is very likely to read email on the same machine they log onto your service with, but that's also a problem with SMS a lot of the time. And of course email is a very insecure channel. But on the whole it will usually be better than nothing, ...


5

This is essentially the scheme that Steam uses if you log in from an "unknown" device. It increases the security slightly, as an attacker would need to compromise both the username/password combination for the application, and the email account of the user. This effectively makes non-targeted attacks worthless. This could be argued as a bad thing - if the ...



Top 50 recent answers are included