Skip to content

Conversation

aeneasr
Copy link
Member

@aeneasr aeneasr commented Dec 10, 2024

Moving forward, OTPs generated by the code strategy will match pattern [0-9a-zA-Z]{8} instead of [0-9]{6}. This increases entropy and makes it easier to defend against reverse brute force attacks.

See https://github.com/ory-corp/cloud/issues/3724

Related issue(s)

Checklist

  • I have read the contributing guidelines.
  • I have referenced an issue containing the design document if my change
    introduces a new feature.
  • I am following the
    contributing code guidelines.
  • I have read the security policy.
  • I confirm that this pull request does not address a security
    vulnerability. If this pull request addresses a security vulnerability, I
    confirm that I got the approval (please contact
    [email protected]) from the maintainers to push
    the changes.
  • I have added tests that prove my fix is effective or that my feature
    works.
  • I have added or changed the documentation.

Further Comments

Moving forward, OTPs generated by the code strategy will match pattern `[0-9a-zA-Z]{8}` instead of `[0-9]{6}`. This increases entropy and makes it easier to defend against reverse brute force attacks.

See ory-corp/cloud#3724
@aeneasr
Copy link
Member Author

aeneasr commented Dec 10, 2024

A test is needed to ensure the legacy code generation still works.

@aeneasr aeneasr closed this Apr 28, 2025
@aeneasr aeneasr reopened this Apr 28, 2025
@tricky42
Copy link
Contributor

Can we follow up on this to close: https://github.com/ory-corp/cloud/issues/3724?

@aeneasr
Copy link
Member Author

aeneasr commented Sep 29, 2025

Yes, just need to figure out how to change it without breaking customers' existing implementations - especially custom UIs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants