Two-Factor Auth Meets Floating Point

Description

A white Two-Factor Authentication modal is shown over a dark background, with a red warning banner that says, "Potential rounding error, please try with a smaller amount." Below it, the prompt reads, "Enter the Two-Factor Authentication code from your Auth app." and the input contains "169 881" above Cancel and blue Verify Code buttons. The joke is that a security confirmation step is blocked by a numeric precision or finance-calculation error, exposing backend transaction validation in the wrong part of the user flow.

Common Tags

TwoFactorAuthentication Authentication ErrorMessages FloatingPointPrecision FloatingPointArithmetic UXFailures SecurityVsUsability TechnicalAbsurdity SoftwareBugs

Comments

Anonymous ★ Top Pick Nothing says high-assurance authentication like discovering your TOTP flow depends on IEEE 754 staying calm.

Anonymous ★ Top Pick

Nothing says high-assurance authentication like discovering your TOTP flow depends on IEEE 754 staying calm.
@UQuark 4y

type OtpRequest struct { Code MoneyAmount json:"code" }
@SamsonovAnton 4y

I don't quite understand: they are at the same time blatantly ignorant to store an integer code in a floating-point variable, but careful enough to check and display a warning about possible rounding error?
1. @RiedleroD 4y
  
  yes.
  
  @SamsonovAnton 4y
  
  Legacy core decorated with cosmetically appealing frontend?
  
  @RiedleroD 4y
  
  doubt it, probably just shit javascript code
2. @glatavento 4y
  
  make bad use of some good library
3. @slnt_opp 4y
  
  And to all that, values from html inputs are strings...