search

opengovsg / starter-kit

A technical kit to quickly build new products
https://start.open.gov.sg
MIT License
36 stars 6 forks source link

feat: increase entropy of email login OTP #230

Closed karrui closed 9 months ago

karrui commented 9 months ago

Current entropy is quite low, and thus we should increase the number of characters of our OTP so the entropy becomes high enough to not be easily brute forced.

The implementation in this PR only uses uppercase characters, and removes some ambiguous characters from the alphanum space, so the resulting character set is 32 characters (aka crockford base32). This set is chosen for a better UX where users do not have to switch between upper and lowercase characters when entering the OTP.

Also added FormSG-like OTP prefix in case emails are delayed etc.

Screenshot 2023-11-28 at 2 14 10 PM

also update bad_request to not retry

vercel[bot] commented 9 months ago

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Comments Updated (UTC)
starter-kit ✅ Ready (Inspect) Visit Preview 💬 Add feedback Dec 1, 2023 9:32am
karrui commented 9 months ago

nvm forgot to update tests done