I have to implement a 2 factor authentication (2FA) feature within an Apache Cordova application so that the user is able to login into the desktop application using the generated token.

Common 2FA algorithms such as TOTP or HOTP use a secret as an input in order to generate a valid token. In my eyes local storage is not an option to persist the secret since there is no way to prevent access to the data through an XSS vulnerability. So how should I tackle this problem? What are the options?

  • Can you explain your architecture a bit? Do you have a server and a mobile client? Is the client running in the browser or as an app? Where are you doing the authentication? – Neil Smithline Jan 20 '16 at 3:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.