Skip to main content
Share Your Experience: Take the 2024 Developer Survey

New answers tagged

-5 votes

What security risks do you see with wrong OTPs appearing in application logs?

Someone who obtained the logs can learn if a given OTP secret is the user's OTP secret by comparing the generated codes of the suspected secret with the logged codes. In case they do not know the ...
allo's user avatar
  • 3,361
23 votes

What security risks do you see with wrong OTPs appearing in application logs?

As well as users accidentally logging passwords as @vidarlo mentioned, I can think of two other potential issues: If a user mis-types their OTP, then what you're logging is a nearly correct OTP, with ...
Gh0stFish's user avatar
  • 11.7k
38 votes

What security risks do you see with wrong OTPs appearing in application logs?

However, they do not want to modify the application code, and are asking me (I have no access to source code) to prove that wrong OTPs in the logs presents security risks. If only OTP's are logged, ...
vidarlo's user avatar
  • 16.5k

Top 50 recent answers are included