8

I am building an web application that uses two-factor authentication.

While implementing the recovery feature, I see that most companies (eg Apple, Facebook, Github) provide a set of ~15 backup codes, which are 7-10 characters-long one-time code to send to the server along with the user's credentials as part of the account recovery process.

I don't understand this practice. Why the need for one-time codes? Wouldn't it be simpler to have one, multiple-use backup code?

  • 1
    Great question. Something inside me screams that auth tokens should always be one-time-use, but I'm struggling to come up with a reason why in this case. – Mike Ounsworth Jul 30 '18 at 12:05
  • Well if the token was multiple use and someone got control of that code, they could perform account recovery whenever they wished. Usually these one time codes have a set time limit attached to them as well to reduce the chances of account hijacking. – Connor J Jul 30 '18 at 13:10
11

Compared with something like SMS or email OTPs, I don't think there's as strong a case to make these one-time-use, but the same arguments still apply.

Let's assume that I have the codes printed out on paper. Then during the recovery process, the recovery code passes through all of the following nodes:

  • Plaintext: My computer's keyboard, OS, browser
  • ENCRYPTED BY HTTPS: browser --> server's TLS endpoint (for ex. CloudFront)
  • Plaintext: TLS endpoint --> networking equipment --> application server
  • Plaintext: Application server <--> db <--> other internal compenents.

The point is that even with HTTPS, there are a lot of nodes that will have your code in memory (or maybe in logs) as part of the recovery process. If the code is multi-use, then you have to trust that every single one of those nodes is honest and not infected with malware. If the code is one-time-use, then once it's been used, you don't care if it ends up in logs or whatever.

It's not a rock-solid argument, but it's the best I can come up with.

  • 1
    The single, multi-use code, now becomes your master password even if you change your other factors. 7-10 chars is not a long master password to have. – schroeder Apr 29 at 13:52
-1

I'm not sure exactly your definition of one multiple-use backup code is. But as for what I know of backup codes for acct recovery, having less total codes might be a bit more secure. The code is only valid once at any time but not multiple times. But yes I don't see the need for so many backup codes, but I do see the need for at least 2 backup codes. Reason is some folks don't have a Fido key or a landline or a relative phone within easy access. But again even with one (or two) backup code(s) it requires due diligence to keeps secured in a safe deposit box (or somewhere) safe.

But I wholeheartedly think that some sort of multi factor recovery backup must be in place. Ideally I feel less likely to be locked out of my own acct the more factor options I have. Whether it's a backup code(s), a landline voice call, a relative's phone or U2F hardware key or all of the above. You can't just depend on your mobile phone for the 2nd factor in 2FA. Folks loose phones all the time due to various reasons.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.