I'm designing a kiosk to use one-time SMS codes as a method of authentication. The method I'm using to generate codes happens inside of an Electron application running on a locked down kiosk, hardened and assembled by a Third-Party.

What should I consider when thinking about the security of the one-time access code? There is a way to generate the codes server-side, but is generating a one-time access code on a kiosk secure?

  • That depends on how it is being generated. What is being used as a source of randomness.
    – Limit
    Feb 27, 2018 at 15:14
  • A 0-left-padded, 6 digit Math.random() which is regenerated on failure. Feb 27, 2018 at 15:59


You must log in to answer this question.

Browse other questions tagged .