undefined | Better HN

0 pointsgnabgib4y ago0 comments

You want your secret to have a secret? Several apps that provide time based one time password storage/management can also be secured with bio-metrics, pins or passwords (Aegis, MS Authenticator). Are you specifically thinking physical tokens only?

0 comments

Spooky234y ago

If you need to conform with higher NIST assurance levels, a one time password generator needs to have a secret as well.

Commercial solutions support this with challenge/response tokens or PINs. I’d love to see an OSS solution.

gnabgibOP4y ago

Perhaps you could link to these NIST standards?

j / k navigate · click thread line to collapse

0 pointsgnabgib4y ago0 comments

0 comments

Spooky234y ago

If you need to conform with higher NIST assurance levels, a one time password generator needs to have a secret as well.

Commercial solutions support this with challenge/response tokens or PINs. I’d love to see an OSS solution.

gnabgibOP4y ago

Perhaps you could link to these NIST standards?

j / k navigate · click thread line to collapse