I'm designing a kiosk to use one-time SMS codes as a method of authentication. The method I'm using to generate codes happens inside of an Electron application running on a locked down kiosk, hardened and assembled by a Third-Party.

What should I consider when thinking about the security of the one-time access code? There is a way to generate the codes server-side, but is generating a one-time access code on a kiosk secure?

  • That depends on how it is being generated. What is being used as a source of randomness. – Limit Feb 27 '18 at 15:14
  • A 0-left-padded, 6 digit Math.random() which is regenerated on failure. – Kris Molinari Feb 27 '18 at 15:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.