0

Security-minded UX designer here.

Some user interfaces reveal the number of characters in the UI for entering a second-factor security code. Is there risk in doing it this way?

How much more secure is it to use a more basic input type?

two ways to enter code

2 Answers 2

4

Providing the number of digits is clearly good for usability.

Knowledge of the number of digits for an attacker limits the search space when trying to hack the security code, so it clearly limits security. But, if the number of digits is large enough or if there are limits on how often one can try to enter the security code, then this limited search space is still large enough to be secure.

So when in doubt I would recommend to rather add an additional digit to the security code than limit the usability too much. The attacker will often quickly figure out how much digits to use by other means anyway, i.e. just hiding it in the user interface usually not fully protects this information.

1
  • 2
    For UX purposes, I think you left the most important and most relevant piece for last; the number of characters is not a secret and is easily discovered. So, sure there are ways to make it more secure, but for the question, hiding the number of characters will do nothing.
    – schroeder
    Commented Nov 5, 2021 at 19:45
0

As Steffen said, the UX win is clear - ease of data entry compared to the attack surface is minimal. Also, if properly implemented on the server side, as soon as you use the code, it can't be reused - so even should surfing shouldn't be a very effective attack here.

However, this also presumes that the code is generated truly randomly. If enough non-random elements are included in the generation of the code - for example, if this was an offline (TOTP-based) code but with not enough additional randomness - then knowing just a few one-time codes and the time they were generated could be used to crack a weak secret.

But since these are being emailed to the user, as long as they're randomly generated, quickly expired, and throttled to prevent direct bruteforce guessing against the web interface ... showing the code itself to the user during data entry should be low risk.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .