Passwordless.ID
-
|
This good to know when creating lifetime for a challenge |
Beta Was this translation helpful? Give feedback.
Answered by
dagnelies
Oct 10, 2024
Replies: 1 comment
-
|
So, just to be clear, the If the attacker has eavesdropped an authentication payload, and wants to "repeat" the login using the same payload, hence the same challenge, he would have to send on average roughly 10^43 requests to your server ...that's a lot of zeroes. |
Beta Was this translation helpful? Give feedback.
0 replies
Answer selected by
lil5
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
So, just to be clear, the
challengeis just a random value, in our case with 18 bytes / 144 bit of entropy by default.If the attacker has eavesdropped an authentication payload, and wants to "repeat" the login using the same payload, hence the same challenge, he would have to send on average roughly 10^43 requests to your server ...that's a lot of zeroes.