1

I have built a simple authentication system for my web application that makes use of the open-source time-based OTP algorithm (RFC 6238). The key for each user is generated when the user is registered in the system. When the user first signs into their account, they are asked to set up their authenticator apps with the provided QR code.

Now, I've done a bit of research, and couldn't find much on the topic, so I'd like to know from you when the secret keys generated by the application need to be reset.

Is it a good idea to have the key reset if the user changes their passphrase? If so, what is the best way to present their new QR code to them? I would assume that there are two choices: the first is to present it to them the next time they sign in, and the second is to send the actual QR to them in the email that lets them know their passphrase changed. For me, the latter is more secure, but I guess it wouldn't make much of a difference if email is used to reset the passphrase anyway.

Your thoughts and insights on this topic would be most appreciated.

Improve this question
1
  • 1
    Why do you want to reset the secret key anyway? If the secret key is still secret you do not need to reset it. Presenting a new QR-Code, which probably contains an unencrypted seed, would be a new threat.
    – cornelinux
    Commented May 8, 2016 at 21:10

1 Answer 1

Reset to default
1

As soon as a user scans the QR code with the application on his smartphone, it will generate one-time passwords (OTPs). OTPs are temporary and valid for a certain amount of time (usually 30-60 seconds). They are generated based on the special algorithm so even if the thief knows your previous OTP he won’t be able to predict the next one. At the same time, the secret key is stored in protected memory areas and if the phone isn’t rooted, nobody can get it. So there is no need to reset it.

Improve this answer
1
  • You might want 5-15 minutes to give the user opportunity to respond if email is unintentionally delayed. Some providers throttle email from what appears to be spammers. If your site gets a sudden influx of new users or password reset requests, that can happen.
    – Berin Loritsch
    Commented Mar 30, 2018 at 12:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.