4 ms·

6 digit is perfectly fine if you only give one try before requiring a different code?

• gizmo 5y ago
  It's a truism that secure things are secure. But engineers make mistakes and that's why you need layers of defense. And when you use recovery codes that are in the realm that can be brute forced you automatically have a problem when rate limiting or other anti-brute force measures fail. Which is why using stronger 2factor codes should be the default, especially for super high impact things like password recovery.
  • Black101 5y ago
    > And honestly, is having to type 12 characters such a burden for the exceptional case of a password reset? I don't think so. If those "engineers" need minimum of 26 characters 1-time use passwords that can only be used one time to feel secure, I don't trust those engineers (unless they allow me to copy and paste it). A one-time-use 6 digit password that can only be tried once is pretty damn secure if it is random.
• md_ 5y ago
  Not really. If you don't rotate the six-digit code, the probability an attacker who tries sequential codes gets the correct code in 1M attempts is 1. But if you do rotate the code, the Bayesian probability that an attacker who tries random codes gets the correct code in 1M attempts is still about 60%, if I did my math right (and of course it asymptotically approaches 1 with more attempts).
  • Black101 5y ago
    who wouldn't do random? But either way it would be insecure if you did sequential... even if you had 2000 characters for your password.