I am developing a website that will allow two factor authentication using Google Authenticator. My question is: what is the best way to store users' secret keys? If I keep it in a database and it is hacked then the attacker would be able to generate one time passwords. And I cannot encrypt it like passwords with one-way encryption because I need this secret seed to generate one-time passwords.
How to securely store Google Authenticator secret key?
4.1k Views Asked by NST At
1
There are 1 best solutions below
Related Questions in SECURITY
- Can MVC.NET prevent SQL-injection at razor or controller level?
- Forgotten password reset page: should the user need to enter a username/email as well?
- Dynamic roles list in CustomAuthorize ASP MVC
- Access roles from multiple applications
- How to Fix TLS CBC Incorrect Padding Abuse Vulnerability on Windows 2003 Server
- Evernote Web Clipper and Content Security Policy
- Invalidate user credentials when password changes
- Spring Boot MVC non-role based security
- Correct Captcha behaviour on error
- Is macro more secure than static const if I don't want someone to know or change the hardcode value?
- In Android, ensuring only pre-decided users can only use the app
- Authenticating plain text passwords against md5 hash in DB using Apache Shiro
- Symfony2 - handle HTTP/Entity user access restrictions
- Client side computation without exposing code?
- searchable row level encryption using java?
Related Questions in AUTHENTICATION
- Access roles from multiple applications
- Different storyboard's entry points depending on a parameter
- SoundCloud Authentication Consistently Returns 401 invalid_grant For Some Users
- sendxmpp not authorized failure (Error AuthSend)
- Retrieve user information from Active Directory on login
- Log in through active directory
- Ember.js REST Auth Headers
- Validate Deezer access token on server
- Why does IIS Anonymous Authentication turn on by itself after I publish my project to server?
- Laravel - session data survives log-out/log-in, even for different users
- How can I share Azure Active Directory authentication between server side and client script?
- django rest framework - token authentication logout
- NameValuePair, HttpParams, HttpConnection Params deprecated on server request class for login app
- How to delete user from _User through Parse REST API
- Cannot login with new SQL User - SQL 2014
Related Questions in ENCRYPTION
- How to customize the output of the Postgres Pseudo Encrypt function?
- encrypted email with entrust certificate is not opening with MS Outlook
- Encrypting with Crypto Node.js and decrypt with window.crypto in Service-Worker
- How to decrypt identity section in web config?
- An exception of type 'System.Security.Cryptography.CryptographicException': keyset does not exist
- IBM DB2 native encryption applied on live database
- crypto.BadPaddingException: data hash wrong (EKYC-Response)
- searchable row level encryption using java?
- AES 256 and Base64 Encrypted string works on iOS 8 but truncated on iOS 7
- Decrypted string returns "Length of the data to decrypt is invalid"
- Storing Encryption Key in Application
- Decryption password Encrypted using Encryptbypassphrase of SQL Server in Java
- Using HTTPS or encrypt response myself
- Encrypting (large) files in PHP with openSSL
- Writing a code to decrypt message from a text file
Related Questions in GOOGLE-AUTHENTICATOR
- Extract OTP Key using regex
- Two Factor Google Authentication not matching the codes on the server- ASP.Net MVC
- Google Authenticator for iOS Missing Files
- Token image in Google Authenticator or FreeOTP
- TokenResponseException: 401 Unauthorized
- How do I add Google-Authenticator to a second phone/tablet (my backup 2FA) for Google-Accounts
- Bigquery could not get default credentials
- Google Authenticator show title in app entry
- Captive portal login using google apps
- how to use django 3 with django-otp to send token sms using SMS service provider for user verification and redirecting to password reset form?
- Trait 'Illuminate\Foundation\Events\Dispatchable' not found
- Is there a Google authenticator API
- Google authentication - TOTP to check remaining seconds
- Google Authenticator Multi-part (TOTP) login implementation for CakePHP
- How to get OTP token for an existing user in django using django-two-factor-auth
Trending Questions
- UIImageView Frame Doesn't Reflect Constraints
- Is it possible to use adb commands to click on a view by finding its ID?
- How to create a new web character symbol recognizable by html/javascript?
- Why isn't my CSS3 animation smooth in Google Chrome (but very smooth on other browsers)?
- Heap Gives Page Fault
- Connect ffmpeg to Visual Studio 2008
- Both Object- and ValueAnimator jumps when Duration is set above API LvL 24
- How to avoid default initialization of objects in std::vector?
- second argument of the command line arguments in a format other than char** argv or char* argv[]
- How to improve efficiency of algorithm which generates next lexicographic permutation?
- Navigating to the another actvity app getting crash in android
- How to read the particular message format in android and store in sqlite database?
- Resetting inventory status after order is cancelled
- Efficiently compute powers of X in SSE/AVX
- Insert into an external database using ajax and php : POST 500 (Internal Server Error)
Popular Questions
- How do I undo the most recent local commits in Git?
- How can I remove a specific item from an array in JavaScript?
- How do I delete a Git branch locally and remotely?
- Find all files containing a specific text (string) on Linux?
- How do I revert a Git repository to a previous commit?
- How do I create an HTML button that acts like a link?
- How do I check out a remote Git branch?
- How do I force "git pull" to overwrite local files?
- How do I list all files of a directory?
- How to check whether a string contains a substring in JavaScript?
- How do I redirect to another webpage?
- How can I iterate over rows in a Pandas DataFrame?
- How do I convert a String to an int in Java?
- Does Python have a string 'contains' substring method?
- How do I check if a string contains a specific word?
You could store it in a secure token (smart card), but then you will have to configure access to that secure token - which brings you back to your original problem. If you are able to perform an action before starting up your application then you can use Password Based Encryption to protect (wrap) the secret key. Or you could require a PIN for the smart card holding the key. USB-memory cards could also be used to permanently store the key (don't forget that backup).
Obviously it is a good idea to protect access to your application in the first place. You may still need the key in memory at some point of time, so an attacker would be able to fish it out if that memory is not protected.
Another method often used it to obfuscate the key. But a determined hacker will usually not have too much trouble retrieving the key whichever way the obfuscation is done.