Skip to content
nviaOTP

The lab

Instruments on the bench

Each module runs entirely in your browser and is embedded in the chapter it illustrates. Open one here to experiment without the surrounding prose.

TOTP workbench

RFC 4226/6238 with every intermediate byte shown, a live 30 s ring, drift windows — and the RFC test vectors recomputed in your browser to prove it.

Open module In chapter: HOTP from the RFC: counter, HMAC-SHA1, dynamic truncation

Attack simulator

SIM swap, AitM relay, MFA fatigue and SMS pumping, fast-forwarded. Switch defenses on and off and watch the outcome and severity change.

Open module In chapter: SIM swap: chain of attack and controls

WebAuthn ceremony mock

Challenge → authenticator assertion → signature verify, with real P-256 signatures and editable inputs so you can break each check.

Open module In chapter: WebAuthn ceremony: challenge, authenticator, attestation

Policy engine

A JSON rules editor that maps risk facts to allow / otp / step-up / deny, evaluated live against sample sessions.

Open module In chapter: Policy design: when to ask for more