Comment on 6 digit OTP for Two Factor Auth (2FA) is brute-forceable in 3 daysparentComments−gnabgib4yYou want your secret to have a secret? Several apps that provide time based one time password storage/management can also be secured with bio-metrics, pins or passwords (Aegis, MS Authenticator). Are you specifically thinking physical tokens only?−Spooky234yIf you need to conform with higher NIST assurance levels, a one time password generator needs to have a secret as well.Commercial solutions support this with challenge/response tokens or PINs. I’d love to see an OSS solution.−gnabgib4yPerhaps you could link to these NIST standards?
Comments
You want your secret to have a secret? Several apps that provide time based one time password storage/management can also be secured with bio-metrics, pins or passwords (Aegis, MS Authenticator). Are you specifically thinking physical tokens only?
If you need to conform with higher NIST assurance levels, a one time password generator needs to have a secret as well.
Commercial solutions support this with challenge/response tokens or PINs. I’d love to see an OSS solution.
Perhaps you could link to these NIST standards?