Web App Security Best Practices

Re:Web App Security Best Practices by Spearchucker on Thursday July 19, 2012 @08:49AM (#4265704)

I've not come across that one before, and... it looks really interesting. I'd argue that it's not completely offline because it requires time-sync, depending on the precision of the client. That assumes the validator is online and can re-sync at any time.

Using a phone is a great solution. Except when the app that requires TOTP authN is also on the phone. That's a shame.

Either way, thanks for positing the link, and clarifying. I learnt something today.

[ Parent | on HN ]

Re:Web App Security Best Practices by icebraining on Thursday July 19, 2012 @10:10AM (#4266056)

I'd argue that it's not completely offline because it requires time-sync, depending on the precision of the client. That assumes the validator is online and can re-sync at any time.

Well, it uses a 30 second window, so it can cope with small drifts; as long as the phone's RTC isn't broken, you should rarely need to re-sync.

I use it with a J2ME application on a Nokia S60 without an internet plan and it works fine.

[ Parent | on HN ]