3

I noticed that Amazon's password reset relies on a 6 digit numeric PIN. Doesn't this reduce every user's account to a 1 in 10^5~ chance of being accessed through brute force guess factoring in a few retries (requesting OTP resend)?

It seems that they put a captcha ahead of this and probably have some timeout where the OTP expires or unspecified limit when too many attempts will lock the account from further retries. But nevertheless this doesn't seem like a very good idea to me. I think Google Apps uses 8 characters with multiple character sets (lowercase, uppercase, numeric, symbol), which seems like how I would implement something like this.

What are good best practices for implementing a similar password reset mechanism with 6 digit numeric PIN on my own web app? Or is this a bad idea?

OTP

OTP2

5
  • As long as the timeout,captcha and only allowing a few attempts are not bypassed.This seems fine
    – yeah_well
    Jul 1, 2020 at 6:33
  • @mentallurg - no, if you pull off 3 retries over 3 resets of OTP, it approximates to 1e-5: 3e-6+3e-6*(1-3e-6)+...
    – Katie
    Jul 1, 2020 at 8:47
  • In your case we have 2 digits so we're down to 1e4 :) Jul 1, 2020 at 10:32
  • 3 retries over 3 resets is still only 9 guesses, so the odds of success are 9/1e6 = 9e-06. You could approximate that as 1e-5 (aka 1 in 1e5), however you don't explain in your question that you get the 1e5 by assuming 3 guesses for 3 retries. If you just guess once then @mentallurg is 100% correct: your odds of success are 1 in 10^6, not 1 in 10^5. Jul 1, 2020 at 10:35
  • My original wording (still unchanged) read: 1 in 10^5~ chance of being accessed through brute force guess factoring in a few retries (requesting OTP resend). I don't know the retry parameters of Amazon's web app, it could be 20 retries before we get locked out for all I know. I explicitly used the tilde sign to show the approximation, and I explicitly emphasized this was factoring in the retries. I really appreciate that you both are spending the time writing these replies, and I'm happy to edit my question if provided a better alternative, otherwise I feel we're being pedantic here.
    – Katie
    Jul 1, 2020 at 17:39

1 Answer 1

2

I noticed that Amazon's password reset relies on a 6 digit numeric PIN. Doesn't this reduce every user's account to a 1 in 10^5~ chance of being accessed through brute force guess factoring in a few retries (requesting OTP resend)?

At face value yes it allows relatively efficient brute forcing. However they will have a) a limited time period when that code is valid and very likely b) a way to prevent repeated submissions (like a CAPTCHA test usually, but could just throttle responses).

It seems that they put a captcha ahead of this and probably have some timeout where the OTP expires or unspecified limit when too many attempts will lock the account from further retries.

So you do know the answer.

But nevertheless this doesn't seem like a very good idea to me.

Find a way to break it and disclose it to them. I find it is pretty solid as it is for this piece of functionality. One time codes can be simple to be used efficiently provided there's measures to prevent brute forcing.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .