Collaborate Disseminate
Assume we chose to change the secret key in HMAC generation for TOTP, every second.
How can we authenticate to such a scheme assuming a 32 byte key is randomly generated passing posix time to srand() for seeding and calling… Continue reading Security Concerns in an Inventory TOTP Scheme using Time-Variant Keys
United Airlines has rolled out a series of updates to its Web site that the company claims will help beef up the security of customer accounts. But at first glance, the core changes — moving from a 4-digit PINs to password and requiring customers to pick five different security questions and answers — may seem like a security playbook copied from Yahoo.com, circa 2009. Here’s a closer look at what’s changed in how United authenticates customers, and hopefully a bit of insight into what the nation’s fourth-largest airline is trying to accomplish with its new system. Continue reading United Airlines Sets Minimum Bar on Security
Is it just me or does TOTP for two factor auth seem like a step back to the days of digest auth where you have to store the symmetrical secret in a reversible manner. Passwords stored in plaintext were–and still are–rampant… Continue reading TOTP: Storing symmetrical secrets
From what I understand, mobile phone-based two-factor authenticators like Google Authenticator implement TOTP which uses a shared secret key between the phone and the authenticating server.
Why did they decide to use a single shared secret… Continue reading Why do TOTP two-factor authenticators use shared keys?