luzifer/vault-otp-ui
1
0
Fork 0
mirror of https://github.com/Luzifer/vault-otp-ui.git synced 2024-11-08 08:10:11 +00:00
Code Issues Releases Wiki Activity

Add project status to README

Browse source 
Signed-off-by: Knut Ahlers <knut@ahlers.me>
This commit is contained in:
Knut Ahlers 2017-06-14 23:24:36 +02:00
parent a02ebf47c8
commit c20c1ec5be
Signed by: luzifer
GPG key ID: DC2729FDD34BE99E
1 changed files with 4 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
README.md
View file

@ -30,3 +30,7 @@ One of the key questions I found myself asking while developing this was whether
On the one hand the first solution would work when being offline because it can be cached in the browser. But seriously: I've never seen a OTP query when not being online so this wasn't a valid reason. On the other hand transmitting the secrets into the browser IMHO would be a major security flaw as - given the case you loose control over your browser having all those secrets stored in the local storage - an attacker would have the chance to generate unlimited one-time passwords for your accounts.
In the end I went with the solution to transmit only names and the currently valid code. This means being offline you are not able to generate a new code but also this means you can revoke access to the Vault keys and immediately stop the attackers ability to generate codes on your behalf.
----
![project status](https://d2o84fseuhwkxk.cloudfront.net/vault-otp-ui.svg)