Re:Web App Security Best Practices
by Spearchucker on Thursday July 19, 2012 @08:49AM
(#4265704)
I've not come across that one before, and... it looks really interesting. I'd argue that it's not completely offline because it requires time-sync, depending on the precision of the client. That assumes the validator is online and can re-sync at any time.
Using a phone is a great solution. Except when the app that requires TOTP authN is also on the phone. That's a shame.
Either way, thanks for positing the link, and clarifying. I learnt something today.
Re:Web App Security Best Practices
by icebraining on Thursday July 19, 2012 @10:10AM
(#4266056)
I'd argue that it's not completely offline because it requires time-sync, depending on the precision of the client. That assumes the validator is online and can re-sync at any time.
Well, it uses a 30 second window, so it can cope with small drifts; as long as the phone's RTC isn't broken, you should rarely need to re-sync.
I use it with a J2ME application on a Nokia S60 without an internet plan and it works fine.
It essentially generates a code based on a pre-shared secret and the current time.
As for the costs, as I said there's plenty of free client applications (Google Authenticator is just the most well known), and not only there are plenty of libraries that you can use on your server, as the RFC that details TOTP provides an implementation in less than 50 short lines of code (+ Java boilerplate); see http://tools.ietf.org/html/rfc6238
And you just need that, plus an extra field in your data store for each user (to store the secret) and a textbox in the login page.