Stack Exchange Network
Stack Exchange network consists of 181 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.
Visit Stack Exchange
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Anybody can ask a question
The best answers are voted up and rise to the top
I need to generate and valid a password / token for an hour.
Client -> generate password (valid for one hour)
Server -> valid it within an hour.
//System needs to work offline (TOTP)
TOTP is normaly 30 seconds... So if i change the TOTP interval to 3600 seconds will i then break the security?
Also open for any better ides then TOTP ?
asked Mar 9, 2017 at 20:17
14322 bronze badges
That is not a good idea for several reasons:
- OTP has to be second factor! It can not be the only factor in authentication
- 30 seconds for TOTP is secure because during that time attacker can not test all the possible options + the first factor.
- For 6 digits it is 1000000 combinations and after 30 seconds (>3000 combinations per second), the combination is different.
- If you extend this time of validity to 1 hour, attacker have plenty of time to brute force this combination (~27 combinations per second)
For this use case, you should choose different way of distributing password
- Password is enabled for that one hour by something on the server side( in that case you need to protect that password).
answered Mar 9, 2017 at 20:31
5,46911 gold badge1818 silver badges3232 bronze badges
You must log in to answer this question.