irrelevant, as OTP time out in minutes?
6 digit OTP for Two Factor Auth (2FA) is brute-forceable in 3 days
11–20 of 42 posts
Re: 6 digit OTP for Two Factor Auth (2FA) is brute-forceable in 3 days
#12What I'm curious about is... If I collect 10 of your OTP keys, can I brute force the secret the generates them?
Re: 6 digit OTP for Two Factor Auth (2FA) is brute-forceable in 3 days
#13I feel like the service has larger problems if they're allowing you 10 requests a second for 3 days...
Not to mention not warning the user that their account is being brute forced.
My recent experience was to get locked out of an account for a few incorrect password attempts. I was the source, had forgotten I changed it or something, the incorrect attempts were a while ago and I don't remember what I was thinking at the time. Required hours on hold waiting for an operator and dancing through stupid hoops (that make more sense to me as audit ass covering than actual security).
Huge pain in the ass.
Re: 6 digit OTP for Two Factor Auth (2FA) is brute-forceable in 3 days
#14irrelevant, as OTP time out in minutes?
Doesn't matter. If you keep trying enough random codes for long enough, eventually you'll guess right.
Re: 6 digit OTP for Two Factor Auth (2FA) is brute-forceable in 3 days
#15What I'm curious about is... If I collect 10 of your OTP keys, can I brute force the secret the generates them?
no
Re: 6 digit OTP for Two Factor Auth (2FA) is brute-forceable in 3 days
#16Earlier quoted context omitted.
Not to mention not warning the user that their account is being brute forced.
My recent experience was to get locked out of an account for a few incorrect password attempts. I was the source, had forgotten I changed it or something, the incorrect attempts were a while ago and I don't remember what I was thinking at the time. Required hours on hold waiting for an operator and dancing through stupid hoops (that make more sense to me as audit ass covering than actual security). Huge pain in the a…
Do you use a password manager? You should.
Re: 6 digit OTP for Two Factor Auth (2FA) is brute-forceable in 3 days
#17What I'm curious about is... If I collect 10 of your OTP keys, can I brute force the secret the generates them?
Not practically. The standard requires that the secret contain at least 128 bits of randomness, and recommends more.
Re: 6 digit OTP for Two Factor Auth (2FA) is brute-forceable in 3 days
#18(I'm the cofounder at https://clerk.dev)
We - and I'm sure every other vendor - limit OTP tries.
The guidelines for authentication are very well-defined by NIST 800-63B. For example:
> In all cases, the authentication SHALL be considered invalid if not completed within 10 minutes.
https://pages.nist.gov/800-63-3/sp800-63b.html#5132-out-of-b...
Depending on the exact type of OTP, NIST may have different guidelines.
Re: 6 digit OTP for Two Factor Auth (2FA) is brute-forceable in 3 days
#19Earlier quoted context omitted.
My recent experience was to get locked out of an account for a few incorrect password attempts. I was the source, had forgotten I changed it or something, the incorrect attempts were a while ago and I don't remember what I was thinking at the time. Required hours on hold waiting for an operator and dancing through stupid hoops (that make more sense to me as audit ass covering than actual security). Huge pain in the a…
Do you use a password manager? You should.
Sure. Doesn't mean I never fuck up.