Closed bootrino closed 5 years ago
Also, check out QRCoder (C#)
Here is the flow:
So basically as long as your base32 string doesn't get sniffed from the get go, you are fine.
Am I correct in understanding that:
@bootrino your interpretation is correct. HOTP and TOTP are based on a shared secret. Keeping the secret confidential between your application and the user's user agent is your responsibility as the application developer (and is typically done via HTTPS as you mention).
You can find a detailed discussion of the shared secret strategy in https://tools.ietf.org/html/rfc4226#section-7.5. This design element is shared between TOTP and HOTP.
Because of the shared secret design, TOTP and HOTP are fundamentally less secure than FIDO U2F and other standards derived from it.
Closing this issue, but feel free to comment if you need further clarification.
Your documentation suggest using qrious - this is fine and works well.
The thing that puzzles me is that the provisioning URI contains the secret key, and yet we send this URI to the client end to be turned into a QR code by qrious. So the secret key isn't secret because it has been sent to the client.
I would have expected that the secret key must never be sent out of the back end - what am I failing to understand?
thanks