4 ms·
I am curious, is there a way to do OTPs with offline databases? I tried poking around with the add-in, but couldn't quite determine whether the implementation
by Guvante 13y ago
I am curious, is there a way to do OTPs with offline databases?
I tried poking around with the add-in, but couldn't quite determine whether the implementation could properly protect from replay attacks, most notably whether a copy of the xml file used and the matching old OTP would be enough to unlock a newer database file.
- ryan-c 13y agoIt's impossible to use OTP as part of an encryption key without some sort of oracle that could do the decryption without the OTP.
- Guvante 13y agoI know you can always backdoor it with the root key, and I decided to give up on this line because of that. In theory you could guarantee the OTP going forward, but it would be impossible to protect going backward, which kind of kills the whole point.