4 ms·
Operator error is a possible reason for a TOTP secret to be inappropriately brief.
by floatingatoll 8y ago
Operator error is a possible reason for a TOTP secret to be inappropriately brief.
- DoctorOW 8y agoMaybe if you count the webapp programmer as the operator. For something like 2FA the end user doesn't pick the secret.
- ovi256 8y agoThe app programmer is definitely considered as an user (or operator) of cryptography libraries. That's what the "user misuse-resistant" best practice is all about: designing tools robust to wider levels of user expertise.
- floatingatoll 8y agoYep, I do.
- CiPHPerCoder 8y agoI've yet to discover a 2FA implementation where the TOTP secret was human-sourced. A language without a secure RNG (e.g. PHP before 7.0, unless you have the right extensions enabled) might be a source of concern, but that's relatively rare.