Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I previously asked a question here What's the use of adding a challenge in the otp algorithm?

Let's suppose that a hacker has succeeded to collect tokens. Is there a way to detect suspicious activity with them ? For example if the user creates another token and uses it and hackers use previous tokens, could server detect this as weird because user shouldn't have used new token before previous ones ?

share|improve this question
up vote 3 down vote accepted

Sure, but this makes a certain set of assumptions.

  1. The OTP is event-based, not time-based
  2. You have to be tracking previously used tokens
  3. You have to track expected future tokens
  4. The user doesn't have the ability to reset their OTP sequence with the initial seed

In theory with an event-based OTP once you use it anything generated before it is unsuable because the server should only be expecting OTP's generated after the current one. So if an attacker collected unused OTPs they wouldn't work after the user authenticates with the latest OTP.

share|improve this answer
ok thanks that's logical. – user310291 Jun 24 '12 at 7:18
how do I know if it is event based not time based for a smartcard with disconnected reader ? – user310291 Jun 24 '12 at 7:21
if one adds these precautions is no challenge is ok ? Because it adds a lot of typing for user. – user310291 Jun 24 '12 at 7:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.