Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

To elaborate a bit on what AlexCoventry already said:

No. The mechanism underpinning TOTP should guarantee that the internal state does not leak from any outputs produced. That is, of course, unless some security flaw is found, but that seems unlikely to ever happen at this point if you use a regular SHA-2-based TOTP. It basically does HMAC_SHA256(secret, time) where the time is known (also to the attacker) but the secret is shared between the two authenticating systems. If you could derive secret from time+output, the mechanism would serve a much more limited purpose. Part of the purpose of TOTP is that an attacker that observed a (number of) login(s) can't predict any future or past tokens for their own use.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: