PrivSec-dev/privsec.dev
1
0
Fork 0
mirror of https://github.com/PrivSec-dev/privsec.dev synced 2024-11-17 12:01:35 -05:00
Code

Fix TOTP duration (#57)

Browse Source
This commit is contained in:
WfKe9vLwSvv7rN 2022-08-25 20:35:09 -07:00 committed by GitHub
parent 4d51101ba8
commit 5ae1761aca
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 55 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
content/knowledge/Multi-factor Authentication.md
View File

@ -31,7 +31,7 @@ The time-limited code is then derived from the shared secret and the current tim
If you have a [Yubikey](https://www.yubico.com/), you should store the "shared secrets" on the key itself using the [Yubico Authenticator](https://www.yubico.com/products/yubico-authenticator/) app. After the initial setup, the Yubico Authenticator will only expose the 6 digit code to the machine it is running on, but not the shared secret. Additional security can be set up by requiring touch confirmation, protecting digit codes not in used from a compromised operating system.
Unlike [WebAuthn](#fido2-fast-identity-online), TOTP offers no protection against [phishing](https://en.wikipedia.org/wiki/Phishing) or reuse attacks. If an adversary obtains a valid code from you, they may use it as many times as they like until it expires (generally 60 seconds + grace period).
Unlike [WebAuthn](#fido2-fast-identity-online), TOTP offers no protection against [phishing](https://en.wikipedia.org/wiki/Phishing) or reuse attacks. If an adversary obtains a valid code from you, they may use it as many times as they like until it expires (generally {{< time "PT30S" >}}30&nbsp;seconds&nbsp;+ grace&nbsp;period{{< /time >}}).
Despite its short comings, we consider TOTP better and safer than Push Confirmations.

54
layouts/shortcodes/time.html Normal file
View File

@ -0,0 +1,54 @@
{{/*
HTML date/time element <time>
https://developer.mozilla.org/en-US/docs/Web/HTML/Element/time
Output:
<time>TimeString</time>
<time datetime="TimeString">Text</abbr>
Syntax:
{{< time "TimeString" />}}
{{< time datetime="TimeString" />}}
{{< time >}}TimeString{{< /time >}}
{{< time "Text" "TimeString" />}}
{{< time text="Text" datetime="TimeString" />}}
{{< time "TimeString" >}}Text{{< /abbr >}}
{{< time datetime="TimeString" >}}Text{{< /abbr >}}
This file and its contents are licensed under the Blue Oak Model License 1.0.0.
https://blueoakcouncil.org/license/1.0.0
(c) 2022 WfKe9vLwSvv7rN
*/}}
{{- $datetime := "" -}}
{{- $text := "" -}}
{{- with .Get "datetime" -}}
{{- $datetime = . -}}
{{- with $.Get "text" -}}
{{- $text = . -}}
{{- else -}}
{{- $text = ($.Inner | $.Page.RenderString) -}}
{{- end -}}
{{- else -}}
{{- with .Get 1 -}}
{{- $datetime = . -}}
{{- $text = $.Get 0 -}}
{{- else -}}
{{- with .Get 0 -}}
{{- $datetime = . -}}
{{- $text = ($.Inner | $.Page.RenderString) -}}
{{- else -}}
{{ $datetime = .Inner -}}
{{- end -}}
{{- end -}}
{{- end -}}
{{- with $text -}}
<time datetime="{{ $datetime }}">{{ . }}</time>
{{- else -}}
<time>{{ $datetime }}</time>
{{- end -}}