Hello everyone, I have a question about TOTP, and about two factor protectors. A post ( security.stackexchange.com/questions/120371/… ), has answered most of my questions, but still one thing left that I could not make myself clear
@Kepotx, time is the reason why the same secret key generates different tokens. Although an attacker knows about the time, he can not guess the token, since he does not know the secret key. However, I think , we should not use the same secret key for a long time, we also need to change it in some interval, am I correct? token
They might exchange a new secret key when they have connection, but when they do not they use the same key. Still I think the longer having the same key, the more danger for compromising.
"I do not think it is relevant for a brute-force attack that the token changes every 30 seconds. Suppose an attacker can test 1000 tokens in the first 30 seconds. That gives a change of 1/1000 of being correct. The next 30 seconds the attacker can simply try the same 1000 tokens again. As the token has changed, there is a new 1/1000 chance of being correct. After 500 * 30 seconds (a little over 4 hours) he has a over 50% chance of success in all the tries."
from a comment on the first question you qoted
6 digit password is not enough combination to avoid the risk of brute force. It's enough to know if someone have the device or not in a short amount of times/attempts, but is not secure enough if there are not further protection
As a result, the secret key must be refreshed and exchanged again, right? Maybe I can investigate the token generator application deeply and find it out :)
I work at a company with a staff of about 1000+. We currently have programming development staff that work on web based projects (approx 50 people).
Recently due to security concerns our IT and Security department implemented a restriction no longer allowing local admin access on machines . The...
So, I’ve been writing a sci-fi novel, that takes place a few centuries in the future. In the novels lore, it says that their was much life throughout the galaxy, but humans were just contacted little. Every other pre type-1 species in the galaxy, or most, had encountered alien life that was seen ...
Ah well. Had the question been phrased better, it could have been an answer : )
I guess the high number of replies is, at least in part, due to the question asking for 'what is common'. It kinda invites people to add their own experience and opinion on the matter.
I once did an internship with a multinational, as an intern, we were -of course- not given local admin rights on our PCs. Problem was, as part of our project we needed to develop an install wizard : )
