News for hackers. Stuff that matters.

A comment on New NIST password guidelines: don't require character types or rotation. Parent comment

Re:New NIST password guidelines: don't require character typ... by CiPHPerCoder on Wednesday December 14, 2016 @03:08AM (#13174555)
You don't need to do that for HOTP/TOTP though.

1. Scan a QR code.

2. You now have a secret value that can generate a deterministic pseudorandom integer securely indefinitely.

Also, SMS-based MFA should be burned to the ground.

[ Parent | on HN ]
Re:New NIST password guidelines: don't require character typ... by AstralStorm on Wednesday December 14, 2016 @04:03AM (#13174695)
Scanning a QR code by hand is easy when you don't have the phone handy. (sarcasm)

Actual OTP should allow you to print out or write down a set of codes.

[ Parent | on HN ]
Re:New NIST password guidelines: don't require character typ... by CiPHPerCoder on Wednesday December 14, 2016 @08:11AM (#13175676)
> Scanning a QR code by hand is easy when you don't have the phone handy. (sarcasm)

That's way different from "I don't want to give out my phone number".

[ Parent | on HN ]
Re:New NIST password guidelines: don't require character typ... by user5994461 on Thursday December 15, 2016 @08:34AM (#13184444)
Both are impossible when not having a phone.
[ Parent | on HN ]
Re:New NIST password guidelines: don't require character typ... by CiPHPerCoder on Thursday December 15, 2016 @11:56AM (#13186002)
It's non sequitur.

"I have a phone number but don't want to give it out" is different than "I don't have a phone".

But hey, there are 2FA devices you can use instead.

[ Parent | on HN ]