Whenever I receive an OTP, the service always says "Never share this password." Why do they include this message?
Is it generic security advice to prevent people from being tricked into sharing access?
Is there some way that kno…
An application is logging wrong OTPs (but not correct OTPs). I asked the application developers to not log wrong OTPs because I do not see any benefits. However, they do not want to modify the application code, and are asking me (I have no…
I am designing a system that allows users to purchase my NFC cards and sign up for an account on my online SaaS website.
The System
For the sake of explanation, assume the website is hosted at domain test.com.
Think of this system as a &qu…
I’m exploring the concepts of TOTP/HOTP in a simple JavaScript application with the help of this OTPAuth plugin.
The knowledge gap I’m hoping to fill is how do mobile MFA applications deduce the countdown timer duration from TOTP.generate(…
Some service like Bitwarden use the password to encrypt part of your personal data, so that nobody except you can access it, and they archive this because the server only gets your password’s hash from your login prompt the server never kn…
When logging in to azure the login process emails me a short one time code to use and doesn’t require a password. I am assuming it is a well trusted process in order to be used on such critical infrastructure, but I am not familiar with th…
Nowadays, 2FA apps usually require you to insert a number which you are presented with when trying to authenticate. For example, the following screenshot is from Microsoft Authenticator:
This is called number matching, and is in contrast …
I’m exploring the security implications of OTP (One-Time Password) authentication and wondering about the effectiveness of server-side protections against brute force attacks.
If an attacker attempts to send all possible OTP codes within a…
We are using TOTP(https://datatracker.ietf.org/doc/html/rfc6238) for a web application to enhance the security. TOTP works on UTC. if system clock drifts OR NTP is not synced, TOTP generated by application (like MS Authenticator, or Google…
Apple provided the capability of using TOTP within iOS itself and I noticed there was a section for Use a verification code on a website or in an app which bypasses the QR Code.
My question is whether that the setup key in the setup verifi…
