92 votes
Accepted

How secure are the FIDO U2F tokens

The answers I've gotten have been good, but I wanted to provide a bit more depth, going specifically in to why the system exists at all, which should explain a bit more about what it's good for. ...
user avatar
  • 82.1k
90 votes
Accepted

Bypass with wrong cvv of debit card and getting OTP

But shouldn't it suppose verify before I get the OTP? What's the reason, Isn' it a security issue? This is absolutely NOT a security issue! quite the opposite it's a protection. Lets go through ...
user avatar
  • 3,699
60 votes

How does Google Authenticator work?

Working: Authenticator implements the Time-Based One-Time Password (TOTP) algorithm. It has the following ingredients: • A shared secret (a sequence of bytes) • An input derived from the current ...
user avatar
58 votes
Accepted

Is revealing the phone number during OTP verification process considered a vulnerability?

The primary attack method against text message OTP is to 'sim swap' and take over the target's phone number. If the site provided the full number in this scenario, they'd be giving the attacker ...
user avatar
  • 71.9k
51 votes

Am I generating email link tokens correctly?

If you are storing all the relevant information (token, expiration time, user) in the database anyway, the only thing you need to make sure about the token is that it is impossible to guess a token. ...
user avatar
  • 64.2k
36 votes

How secure are the FIDO U2F tokens

U2F is capable of using an encrypted channel using public key crypto to ensure ONLY the right server can get the one time token. This means plugging it in when on a phishing site means nothing happens&...
user avatar
  • 821
33 votes
Accepted

Is emailing sign in links bad practice?

A magic link alone is not necessarily bad. A 512 bit entirely random value is going to be no easier to guess than a 512 bit private key. In general it is considered good practice to expire them after ...
user avatar
  • 10.9k
32 votes

Don't one-time recovery codes for 2FA introduce a backdoor?

tl/dr: One time recovery codes give account owners an option for regaining lost access. People who consider this an additional risk can always ignore it or destroy it, but people who are worried ...
user avatar
30 votes

Why do many websites hide input when entering an OTP?

The reason to hide passwords is to prevent shoulder surfing: someone being physically present (or someone observing through a camera) might be able to read the password on the screen. This is also a ...
user avatar
26 votes

Is revealing the phone number during OTP verification process considered a vulnerability?

This is not about a "vulnerability". This is about personally identifiable information (PII). It's the same reason why credit cards numbers are not displayed in full on sites either. Anyone ...
user avatar
  • 123k
24 votes

How secure are the FIDO U2F tokens

I have not yet fully explored the spec. But: In what way is U2F fundamentally different from OTP? U2F is not using an OTP. It is really about site authentication and using possession of a private key ...
user avatar
  • 767
24 votes

Is emailing sign in links bad practice?

There are three problems here. As the documentation writes, email is not a secure protocol. Emails are stord in plaintext on the mailservers. The encryption between servers and between servers and ...
user avatar
  • 48.8k
22 votes

What are the differences between the U2F and UAF FIDO authentication standards?

Seems like you've got it pretty much down. Universal Authentication Framework (UAF) is meant as a replacement for simple authentication, and Universal Second Factor (U2F) is meant to replace today's ...
user avatar
22 votes
Accepted

Is there any alternative beside sending One-Time-Password via SMS?

Why can't you use TOTP or HOTP which is standard and supported by most authenticator apps? When people register for your service they need to enroll their authenticator app by scanning a QR code ...
user avatar
  • 12.7k
22 votes

How secure are password managers with account recovery?

Having a recovery option is perfectly fine as long as it is adequately secured. Whether you prefer losing your passwords if you lose the master password or want to trust the password manager company ...
user avatar
  • 1,905
20 votes
Accepted

LastPass Grid Authentication vs Google Authenticator which one is more secure?

I personally prefer Google Authenticator which is basically an elegant implementation of Time-Based One-Time Password Algorithm but I would not feel comfortable saying it “is more secure”. To use one ...
user avatar
  • 4,168
18 votes

Why is the truncate function for HMAC one time passwords so complicated?

It is a bit of a fetish. As far as we currently know, there is no reason to believe that using the first four bytes of the HMAC output would not be equally secure. However, lack of reason to believe ...
user avatar
17 votes

How secure are the FIDO U2F tokens

I just read some of the specs because I wanted to know if the device stores the actual (private) keys. I can try to answer some of the questions. OTP are simply one-time tokens, while U2F is based on ...
user avatar
  • 271
16 votes

Why do many websites hide input when entering an OTP?

Speculating about the motive of other developers is perhaps a poor use of time, but I can see one advantage that hasn't been mentioned. Psychologically, making it look like a password helps people ...
user avatar
  • 1,818
14 votes
Accepted

What happens if a (google authenticator) one time password QR code is leaked?

The QR code remains valid and usable; nothing will make it stop working. This actually makes it very dangerous to leak the QR code. If an attacker sees it, even years after you use it the first time, ...
user avatar
  • 39.6k
14 votes

Is revealing the phone number during OTP verification process considered a vulnerability?

If the full number were listed then I could visit your account, request a new password, and know your phone number. The last two digits are a tradeoff that permit you to know its (likely) your number ...
user avatar
  • 38.1k
13 votes

Bypass with wrong cvv of debit card and getting OTP

As well as the general rule of not giving the attacker information by rejecting too early, there are some things specific to the payment industry which are somewhat relevant. Although often ...
user avatar
  • 3,780
12 votes
Accepted

One Time Password Algorithm for Humans

There are some commercial schemes, e.g. GridGuard from SyferLock that claim to do this, but I have never used them (I have no affiliation). This relies on the user choosing correctly from multiple ...
user avatar
  • 7,927
12 votes

Is it secure to store a two factor authentication seed in a password manager?

I don't think it's as bad an idea as you assume. Think about what threats you're trying to guard against by using TOTP, and think about what attack scenarios are made easier (or not) if storing the ...
user avatar
  • 3,845
12 votes

Best practices for storing 2FA recovery codes

First of all, let's clarify that 2FA recovery codes are used to bypass 2FA itself. 2FA's main purpose is to make sure that you provide a secret from two different "channels", for example, something ...
user avatar
12 votes
Accepted

Do all Authenticator Apps use the same algorithm?

these apps are use the same algorithm which is a generic algorithm not an application developer's algorithm. Am I right ? Yes. There are two commonly used protocol for authenticator apps: HOTP (HMAC-...
user avatar
  • 31.1k
11 votes

Does adding two-factor authentication by OTP really make KeePass more secure

From reading the source it looks like the secret is stored on the Yubikey and stored encrypted multiple times with different keys inside the otp.xml file. The encryption keys are derived from the next ...
user avatar
  • 276
11 votes
Accepted

How to store the access token / password reset token in the database?

Since you know that your plaintext tokens are unique (or at least this is a logical inference) you don't need a salt. The salt's intention is solely to provide hash-uniqueness in the case of identical ...
user avatar
  • 132k
11 votes
Accepted

Why use one-time codes for two-factor authentication backups?

Compared with something like SMS or email OTPs, I don't think there's as strong a case to make these one-time-use, but the same arguments still apply. Let's assume that I have the codes printed out ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible