6 digit OTP for Two Factor Auth (2FA) is brute-forceable in 3 days
1–10 of 42 posts
Re: 6 digit OTP for Two Factor Auth (2FA) is brute-forceable in 3 days
#2[deleted]
Re: 6 digit OTP for Two Factor Auth (2FA) is brute-forceable in 3 days
#3> For a high value account, a motivated attacker can and will continue at this point. (And if you don't consider your accounts high value, why are you bothering with 2FA?).
Because credential stuffing is highly lucrative, even when no individual account is particularly high value, and is the most common way accounts are compromised on most services. There are other things a _user_ might do to prevent credential stuffing, like using unique passwords, but 2FA has the benefit of actually being visible/verifiable for you as a service provider.
Re: 6 digit OTP for Two Factor Auth (2FA) is brute-forceable in 3 days
#4Its a shame the TOTP standard does nor support variable code length, 8 symbols seems to be better for high value accounts but still usable
Re: 6 digit OTP for Two Factor Auth (2FA) is brute-forceable in 3 days
#5I feel like the service has larger problems if they're allowing you 10 requests a second for 3 days...
Re: 6 digit OTP for Two Factor Auth (2FA) is brute-forceable in 3 days
#6Any site that allows you more than a few attempts at a time has already failed.
Re: 6 digit OTP for Two Factor Auth (2FA) is brute-forceable in 3 days
#7This article is pointless clickbait - what percent of systems don't have some sort of throttling or lockout after X number of bad guesses - damn few I would say. Even the most basic, low budget systems I have developed or worked on have throttling rules in place - many with exponentially increasing timeouts that would prevent this sort of attack.
If a website/system does not implement even the most basic security practices, then there are probably a lot of easier ways to hack into in than trying 100,000+ different passwords in a row.
Re: 6 digit OTP for Two Factor Auth (2FA) is brute-forceable in 3 days
#8I feel like the service has larger problems if they're allowing you 10 requests a second for 3 days...
Not to mention not warning the user that their account is being brute forced.
Re: 6 digit OTP for Two Factor Auth (2FA) is brute-forceable in 3 days
#9>An alternative is account locking after a number of failures, which is much better. However it also brings problems. It means that your 2FA must only be accessible for people who already have passed one level of security, otherwise you have a denial of service vulnerability.
Isn't that how most 2fa flows work? You enter username + password, if it gets accepted you move onto a second page where you enter your 2fa code.
> Plus you need all the account unlocking procedures etc, and need to make sure they are secure, and not actually effectively another attack route.
But realistically speaking don't you need a password reset flow? If so you can just reuse the password reset flow for lockouts as well.
Re: 6 digit OTP for Two Factor Auth (2FA) is brute-forceable in 3 days
#10This article is pointless clickbait - what percent of systems don't have some sort of throttling or lockout after X number of bad guesses - damn few I would say. Even the most basic, low budget systems I have developed or worked on have throttling rules in place - many with exponentially increasing timeouts that would prevent this sort of attack. If a website/system does not implement even the most basic security pra…
It reminds me of the 4-digit PINs on payment cards --- yes, the "keyspace" is tiny, but you're going to be locked out long before you get close to exhausting it.