5 ms·
For example, there are 999999 combinations for TOTP. You might not be able to get through all those combinations in 30s but you could probably get through enoug
by gtsteve 6y ago
For example, there are 999999 combinations for TOTP. You might not be able to get through all those combinations in 30s but you could probably get through enough to give you a good chance of access on a long enough timeline.
So, you lock out IP addresses. The attackers move to using a botnet.
So, you lock out specific accesses to an account. The attackers can't move forward now but they can quite easily and cheaply deny access to a given account indefinitely.
So when implemented correctly, with a strong enough password policy and a way to introduce delay, i.e. with bcrypt2 and IP address locking, etc, 2FA makes it more difficult. The time to access is considerably longer for an attacker.
Of course, you've got similar problems with a password and a second TOTP but you've increased the difficulty level massively as the attacker must now have a working password before they can work on the 2FA dialog. At this point, you can easily spot suspicious behaviour and warn users, etc.
- godot 6y agoMaybe I misunderstood the OP or the standard usage of the acronym OTP/TOTP is only for referring to 2FA tokens? I interpreted his question to mean a one-time-password, not necessarily a numeric 2FA token, but a string password with ascii characters, with any length (or a reasonably long one at least), emailed or SMS'd to the user. I don't have a great answer for OP other than, I've seen some big sites do it. For example, I never remember the password of my rarely-used Twitter account. Every time I have to log in, I use the OTP feature and get emailed a login link.
- theschmed 6y agoPassword resets are a great example of an almost universal usage of OTP, thank you. Of course, they deliberately discourage you from using that regularly, by making you set a new passphrase when you log in from a "magic link" sent by email.