I am developing a website that will allow two factor authentication using Google Authenticator. My question is: what is the best way to store users' secret keys? If I keep it in a database and it is hacked then the attacker would be able to generate one time passwords. And I cannot encrypt it like passwords with one-way encryption because I need this secret seed to generate one-time passwords.
How to securely store Google Authenticator secret key?
4.1k Views Asked by NST At
1
There are 1 best solutions below
Related Questions in SECURITY
- Embedding Microsoft Power BI into Liferay
- PowerBI hierarchy creation without the cloud
- How to create nested tiles in Power View
- BI Designer many to many relationship
- Microsoft Power BI Designer data model to Excel or PowerPivot
- How to link table row content to source in Power View
- Stream Analytic to PowerBI complains about PowerBIOutputAdapterTransientError
- How can I connect datasets from machine learning to SQL database in Azure?
- drilling from powerbi to ssrs
- How do you connect an Azure Table Storage with Power BI through Stream Analytics?
Related Questions in AUTHENTICATION
- Embedding Microsoft Power BI into Liferay
- PowerBI hierarchy creation without the cloud
- How to create nested tiles in Power View
- BI Designer many to many relationship
- Microsoft Power BI Designer data model to Excel or PowerPivot
- How to link table row content to source in Power View
- Stream Analytic to PowerBI complains about PowerBIOutputAdapterTransientError
- How can I connect datasets from machine learning to SQL database in Azure?
- drilling from powerbi to ssrs
- How do you connect an Azure Table Storage with Power BI through Stream Analytics?
Related Questions in ENCRYPTION
- Embedding Microsoft Power BI into Liferay
- PowerBI hierarchy creation without the cloud
- How to create nested tiles in Power View
- BI Designer many to many relationship
- Microsoft Power BI Designer data model to Excel or PowerPivot
- How to link table row content to source in Power View
- Stream Analytic to PowerBI complains about PowerBIOutputAdapterTransientError
- How can I connect datasets from machine learning to SQL database in Azure?
- drilling from powerbi to ssrs
- How do you connect an Azure Table Storage with Power BI through Stream Analytics?
Related Questions in GOOGLE-AUTHENTICATOR
- Embedding Microsoft Power BI into Liferay
- PowerBI hierarchy creation without the cloud
- How to create nested tiles in Power View
- BI Designer many to many relationship
- Microsoft Power BI Designer data model to Excel or PowerPivot
- How to link table row content to source in Power View
- Stream Analytic to PowerBI complains about PowerBIOutputAdapterTransientError
- How can I connect datasets from machine learning to SQL database in Azure?
- drilling from powerbi to ssrs
- How do you connect an Azure Table Storage with Power BI through Stream Analytics?
Trending Questions
- UIImageView Frame Doesn't Reflect Constraints
- Is it possible to use adb commands to click on a view by finding its ID?
- How to create a new web character symbol recognizable by html/javascript?
- Why isn't my CSS3 animation smooth in Google Chrome (but very smooth on other browsers)?
- Heap Gives Page Fault
- Connect ffmpeg to Visual Studio 2008
- Both Object- and ValueAnimator jumps when Duration is set above API LvL 24
- How to avoid default initialization of objects in std::vector?
- second argument of the command line arguments in a format other than char** argv or char* argv[]
- How to improve efficiency of algorithm which generates next lexicographic permutation?
- Navigating to the another actvity app getting crash in android
- How to read the particular message format in android and store in sqlite database?
- Resetting inventory status after order is cancelled
- Efficiently compute powers of X in SSE/AVX
- Insert into an external database using ajax and php : POST 500 (Internal Server Error)
Popular # Hahtags
Popular Questions
- How do I undo the most recent local commits in Git?
- How can I remove a specific item from an array in JavaScript?
- How do I delete a Git branch locally and remotely?
- Find all files containing a specific text (string) on Linux?
- How do I revert a Git repository to a previous commit?
- How do I create an HTML button that acts like a link?
- How do I check out a remote Git branch?
- How do I force "git pull" to overwrite local files?
- How do I list all files of a directory?
- How to check whether a string contains a substring in JavaScript?
- How do I redirect to another webpage?
- How can I iterate over rows in a Pandas DataFrame?
- How do I convert a String to an int in Java?
- Does Python have a string 'contains' substring method?
- How do I check if a string contains a specific word?
You could store it in a secure token (smart card), but then you will have to configure access to that secure token - which brings you back to your original problem. If you are able to perform an action before starting up your application then you can use Password Based Encryption to protect (wrap) the secret key. Or you could require a PIN for the smart card holding the key. USB-memory cards could also be used to permanently store the key (don't forget that backup).
Obviously it is a good idea to protect access to your application in the first place. You may still need the key in memory at some point of time, so an attacker would be able to fish it out if that memory is not protected.
Another method often used it to obfuscate the key. But a determined hacker will usually not have too much trouble retrieving the key whichever way the obfuscation is done.