increase length of of Scratch codes about google-authenticator HOT 3 CLOSED

Comment #1 originally posted by [email protected] on 2010-12-15T00:11:49.000Z:

Hi guys,

After going though the code for this one, I have opted to create my own authentication system that is compatible with Google Authenticator, but uses its own pam module and has more secure scratch codes (as well as other authentication means). If you interested its on google code: http://code.google.com/p/otp-sso/

This is a java based webapp (glassfish) that will authenticate users against yubikey, scratchcodes and google authenticator created totp codes (straight from the RFC). This is still in early development (and looking for co-developers if anyone is interested), but as of right now it can be used (and I am using it for) Google apps SSO/SAML, Freeraduis authentication (linux, windows and wireless auth) as well as having its own (really early start) web interface login and pam module. This is not something for the production environment just yet, but if you are looking for an easily working SAML / Google Apps SSO solution for Yubikey's, Scratch Codes and TOTP Codes it does this.

Comments/Feedback welcome.

Jake

from google-authenticator.

Comment #2 originally posted by [email protected] on 2011-02-26T23:33:48.000Z:

Hi Jake,

Thanks for the comments and thanks for posting your code! Balancing the length of the codes can be a trade-off between difficulty of guessing and usability. For most situations, I feel that 8 digits is enough if your system has an adequate delay between failed login attempts.

Thanks,
Drew

from google-authenticator.

Comment #3 originally posted by [email protected] on 2011-03-09T20:12:32.000Z:

Closing this issue for now. Please re-open if you believe that there is any action that we should be taking.

from google-authenticator.