Bad practice with generate_one_time_code
See original GitHub issueNot so long ago, I came across the fact that with two-factor authentication comes empty response (#53). It turned out that if you authorize the client several times without restarting application, the same one-time code will be generated. It’s a bad idea to pass a variable like time.time()
to the default value:
def generate_one_time_code(shared_secret: str, timestamp: int = int(time.time())) -> str:
# generating one-time code
Probably, it should look like this:
def generate_one_time_code(shared_secret: str, timestamp: int = 0) -> str:
if not timestamp:
timestamp = int(time.time())
# generating one-time code
Issue Analytics
- State:
- Created 6 years ago
- Reactions:1
- Comments:6 (5 by maintainers)
Top Results From Across the Web
5 bad coding practices that make other developers hate your ...
It's five cardinal sins you can commit in your code. Those bad programming practices are so evil that every developer will hate your...
Read more >paper-modeling-and-verification-of-wom-security-protocols ...
Fortunately, nowadays it is becoming common practice to accompany the design of new security ... RESULT Non-interference vn is true (bad not derivable)....
Read more >The steampy from bukson - GithubHelp
Generate one time code for logging into Steam using shared_secret from SteamGuard file. ... Bad practice with generate_one_time_code.
Read more >Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start FreeTop Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Top GitHub Comments
Already on master, much much thanks!
You saved my life! I’m currently creating a service with multiple steam bots. A bot is getting logged in as soon as a user requests it but since the app could already be running for some minutes or hours, the login fails with the error “Invalid Credentials”. I think this bug is also caused by the generate_one_time_code method.