3

I want to know if there's a way or known way to implement this:

Lets say I have:

  • a C# WinForms program
  • a Javascript Mobile Application (Android / iOS)

What I want to do is:

  1. for my C# application to show a one-time use (disposable) code or token.
  2. The user enters the code or token in the mobile app
  3. The code is no longer available for use and the c# application and mobile application are linked for file exchange (.jpg, .docx, etc)
  4. Once the session between the two ended, a new code or token is generated.

Is there any existing approach for this? If not, how would be the best way to implement this?

  • 1
    Do you have a server the two applications are connected to? – svick May 9 '16 at 17:55
  • 7
    Are you asking for a way to generate single-use tokens such that external attackers can't guess the token? Or how to ensure the code is only used once? Or how to establish the connection? – Ixrec May 18 '16 at 21:16
1

The way I would do this is as follows:

  1. Generate a random string with a function like this one.

  2. Store this token, along with the expiry time, user id (if applicable) and the time/date created. I'd suggest creating an object/class for this and only keeping it in a temporary place (so it's not persisted when you close your program).

  3. Once inputted on your app, send this code to the Winforms machine from your app using a socket listener like this one.

  4. When the Winforms machine receives the code, it verifies if it's correct then if it's still valid. If valid, let the app connect with the app.

  5. When done, you need to delete the stored code after an attempt has found it valid or invalid. If the code is valid it doesn't need to be used again and if it's invalid (time expired, wrong user etc.) it should be deleted to avoid misuse.

0

You could base the code on the logged in user and a timestamp, to verify it you simply regenerate it server-side and verify if it matches.

I believe this approach is common among existing two-factor auths

  • 1
    Normally the code is generated on the server rather than the client for auth, as giving the client tools to generate security codes for server auth sounds like it could lead to exploits being easier to create. – Connor Jan 30 '18 at 9:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.