9

I am building an web application that uses two-factor authentication.

While implementing the recovery feature, I see that most companies (eg Apple, Facebook, Github) provide a set of ~15 backup codes, which are 7-10 characters-long one-time code to send to the server along with the user's credentials as part of the account recovery process.

I don't understand this practice. Why the need for one-time codes? Wouldn't it be simpler to have one, multiple-use backup code?

Improve this question
2
  • 1
    Great question. Something inside me screams that auth tokens should always be one-time-use, but I'm struggling to come up with a reason why in this case.
    – Mike Ounsworth
    Jul 30, 2018 at 12:05
  • Well if the token was multiple use and someone got control of that code, they could perform account recovery whenever they wished. Usually these one time codes have a set time limit attached to them as well to reduce the chances of account hijacking.
    – Connor J
    Jul 30, 2018 at 13:10

2 Answers 2

Reset to default
11

Compared with something like SMS or email OTPs, I don't think there's as strong a case to make these one-time-use, but the same arguments still apply.

Let's assume that I have the codes printed out on paper. Then during the recovery process, the recovery code passes through all of the following nodes:

  • Plaintext: My computer's keyboard, OS, browser
  • ENCRYPTED BY HTTPS: browser --> server's TLS endpoint (for ex. CloudFront)
  • Plaintext: TLS endpoint --> networking equipment --> application server
  • Plaintext: Application server <--> db <--> other internal compenents.

The point is that even with HTTPS, there are a lot of nodes that will have your code in memory (or maybe in logs) as part of the recovery process. If the code is multi-use, then you have to trust that every single one of those nodes is honest and not infected with malware. If the code is one-time-use, then once it's been used, you don't care if it ends up in logs or whatever.

It's not a rock-solid argument, but it's the best I can come up with.

Improve this answer
1
  • 2
    The single, multi-use code, now becomes your master password even if you change your other factors. 7-10 chars is not a long master password to have.
    – schroeder ♦
    Apr 29, 2019 at 13:52
-1

I'm not sure exactly your definition of one multiple-use backup code is. But as for what I know of backup codes for acct recovery, having less total codes might be a bit more secure. The code is only valid once at any time but not multiple times. But yes I don't see the need for so many backup codes, but I do see the need for at least 2 backup codes. Reason is some folks don't have a Fido key or a landline or a relative phone within easy access. But again even with one (or two) backup code(s) it requires due diligence to keeps secured in a safe deposit box (or somewhere) safe.

But I wholeheartedly think that some sort of multi factor recovery backup must be in place. Ideally I feel less likely to be locked out of my own acct the more factor options I have. Whether it's a backup code(s), a landline voice call, a relative's phone or U2F hardware key or all of the above. You can't just depend on your mobile phone for the 2nd factor in 2FA. Folks loose phones all the time due to various reasons.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .