The Public OTP Fallback

Description

A browser displays an ASUS offer redemption page at `asuspromo.in/registration/redeem` with navigation links for "REFERRAL PROGRAM", "ABOUT ASUS", "OFFERS", and "TICKET STATUS". The page heading says "OTP" and the message reads, "We are facing an SMS issue. Please use 607161 as your OTP"; the "ENTER OTP" field is filled with `607161`, with blue "VALIDATE" and "RESEND OTP" buttons below. The security joke is that a fallback meant to solve SMS delivery has effectively turned a second factor into a public shared password.

Common Tags

Authentication Security AuthenticationMethods TwoFactorAuthentication SecurityFlaws WebSecurity LaxSecurityAttitudes SecurityTheater SecurityVsUsability SensitiveDataExposure BadPractices UXFailures WebDevelopment

Comments

Anonymous ★ Top Pick Nothing says multi-factor authentication like hard-coding the second factor into the page copy.

Anonymous ★ Top Pick

Nothing says multi-factor authentication like hard-coding the second factor into the page copy.
@rubelem 3y

if (req.body.otp === '607161') return res.status(200)
@callofvoid0 3y

what the hell is this ?