3 ms·
Nope If anything, the codes should be longer - 8 digits would be far better (8-10 digits bumps up against what a person can easily keep in their mind at one ti
by warrenm 5y ago
Nope
If anything, the codes should be longer - 8 digits would be far better (8-10 digits bumps up against what a person can easily keep in their mind at one time for long enough to type it)
- i0nutzb 5y agoNot necessary _longer_ but could include letters too.
- catskul2 5y agoWhy should the codes be longer? Is your concern brute force attacks on the code across a network connection on something that is attempt limited?
- warrenm 5y agoit's kind of interesting that physical totp generators like entrust, securid, etc all went with 8 digits vs the "typical" digital totp codes being 6 digits long I'm not so much concerned with brute force as that 8 is better than 6
- quaffapint 5y agoPer RFC (for HOTP, which is just TOTP w/o the time element)... "The HOTP value must be at least a 6-digit value. It is also desirable that the HOTP value be 'numeric only' so that it can be easily entered on restricted devices such as phones." 6 was defaulted to in the TOTP for being 'secure enough' and easy enough for most people to remember.
- Spooky23 5y agoExactly, it’s a pragmatic choice. There are scenarios where that doesn’t provide sufficient assurance, but those scenarios are also not really suited for TOTP in the first place!