Tag Info

New answers tagged

0

I think all the answers pointed out, that you will weaken your security. Since you either make a password reusable (if you allow the same one time password to be used for a time period again) or you weaken security by allowing several OTPs to be valid at once. Well, I saw many of those requests during my time implementing an OTP solution and I can ...


1

If you're thinking of doing all the work to send the same P for a given user within an X hour window, why not do the same amount of work to permit your authentication backend to accept any of the N P's you've sent over the last X hours? That neatly resolves your issue with impatient users without compromising the OT in OTP. (Needless to say, all P should ...


3

The idea behind an OTP is that it can only ever be used once, hence "One Time Pin". If you reuse the same OTP for a certain time period you are not using it only once. The single use is to ensure that a lost of compromised OTP becomes ineffective as soon as a new one is requested. If your "OTP" that is valid for a certain time period (2 hours in your ...


0

The only drawback I can think of - which is a serious drawback to take into account) is that you are introducing new logic into the process which will complicate your implementation and eventually might introduce bugs which will degrade your security. By the way - if you want to try and solve the user experience you might just add a comment on your UI that ...


1

The main concern I would have with your proposed method of generating card grid data is whether the resulting grid numbers are sufficiently random. Since you are running randomly generated data through a HMAC (which should be fine) but then also a "mathematical formula" it is possible that could bias the resulting numbers. If an attacker knows that certain ...


1

You seem to be engineering a lot of unnecessary complexity in...unless I've missed something. If you have 64 cells generate a 64 character sequence of crypto random digits and store it. Print your card from this. And check responses to challenges against it. It's really very similar to having a 64 character password and asking for a few characters from ...


2

(I worked for Google's Account team, specializing in Usable Security issues just like this one.) In authentication, there are three basic factors: "has a", "knows a", or "is a". The two systems under discussion are both "has a". In the case of LastPass, the user has a piece of paper. In the case of GAuthenticator, the user has a particular smartphone. As ...


0

Both iOS and Android offer APIs for storing sensitive data to applications. On iOS this is known as the Keychain API. What happens after the application is removed is based on a lot of different factors but items in the iOS Keychain do persist after apps are uninstalled.


12

I personally prefer Google Authenticator which is basically an elegant implementation of Time-Based One-Time Password Algorithm but I would not feel comfortable saying it “is more secure”. To use one of my favourite buzzwords… it all comes down to Threat Modelling. What exactly are you trying to protect against? Is it a technical attacker who might be able ...



Top 50 recent answers are included