Contents
How to store TOTP secret in the database?
Combine both methods: Combine the password with a locally stored key, and use this as the encryption key for the TOTP secret. This way, if the database is leaked and the attacker knows the password, they still can’t decrypt the TOTP secret unless they have access to the stored key
Is there a way to encrypt the TOTP secret?
Encrypt the TOTP secret using key stored on the server: This wouldn’t be ideal since you’d be encrypting everything with the same key, but a database can be leaked without the attacker having full access to all files on the server. In that scenario, at least the TOTP secrets are still protected.
How is API secret stored in plain text?
Encrypt the API key value with AES, using k as the key, and store the ciphertext in the database. Discard the plaintext API key and k. When the user logs in, the webapp knows their password and uses it to compute k, which is then used to decrypt the API key and display it to them.
Why are passwords stored in plaintext on a computer?
If they just send you your password instead of a reset link, it’s being stored in plaintext. Encryption may sound like a strong way to store passwords, but it’s really just a step above plaintext. An encrypted password can generally be decoded with a key, and if the hackers can find or guess it, the encryption is useless.
How to calculate the time in seconds in TOTP?
More specifically T = (Current Unix time – T0) / X where: – X represents the time step in seconds (default value X = 30 seconds) and is a system parameter; – T0 is the Unix time to start counting time steps (default value is 0, Unix epoch) and is also a system parameter;
Which is the correct formula for the TOTP algorithm?
Basically, we define TOTP as TOTP = HOTP (K, T) where T is an integer and represents the number of time steps between the initial counter time T0 and the current Unix time (i.e. the number of seconds elapsed since midnight UTC of January 1, 1970). More specifically T = (Current Unix time – T0) / X where: