View source for Changes to the 2FA token generation recommendations for existing sites

==Does This Affect my Website?== <!--T:16-->
</translate>

<translate><!--T:17--> As stated in the initial report provided by Hanno Böck, he said regarding the usage of the insecure ''rand'' function:</translate>

[...]
<translate><!--T:18-->
''I consider the practical risk of this to be low. In order to attack this an attacker would have to know the approximate time when the
person created his TOTP secret. PHP internally mixes in microseconds twice, so one could maybe reduce the possible options for the key to a few million, which is still very impractical for a real attack.''</translate>
[...]

<translate><!--T:19--> And for the usage of 10 vs. 20 bytes, he said:</translate>

[...]
<translate><!--T:20-->
''The code by default uses 10 bytes for the secret. 10 bytes is 80 bits. The risk here is low. 80 bits is still outside of any practical attack. Nevertheless I think security requirements (and even recommendations) of the RFC should be followed, so I recommend changing this to 20 bytes (AKA 160 bits).''</translate>
[...]

<translate><!--T:22--> Based on that information the JSST came to the conclusion to implement the changes as noted above. This does not mean that practically all 2FA tokens generated prior the patch have to be regenerated as they still work as expected and are still secure form a practical standpoint.</translate>
<translate><!--T:23--> It should also be obvious that the changes made here only affect secrets generated after this change.</translate>

__NOTOC__
<noinclude>
[[Category:Version 3.9 FAQ{{#translation:}}]]
[[Category:Version 3.9.25 FAQ{{#translation:}}]]
[[Category:FAQ{{#translation:}}]]
</noinclude>