Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In my company, they don't allow accessing the company email or servers from outside the company network.

To access the email from outside the network, you have to use: Username, password and a number generated from a small number generator.

How does this verification method work?

small number generator

share|improve this question
up vote 24 down vote accepted

There are several methods for such tokens. One of them is HOTP: the token and the server both share a common secret value, and a counter; from the secret and the current counter value, a one-time password can be generated (the token displays it, the server verifies that the entered password matches that which was expected).

Some tokens also include the current date and time in the process, so that the one-time password is also limited in time: this supposes that the user pushes the button on the token and immediately enters the displayed password (the use of time prevents the user from generating some OTP in advance and writing them down on a piece of paper). The usual standard for that is TOTP.

share|improve this answer
Yep. This is why if your kid decides to hit the button more than a few times, you'll OPT will no longer work and you'll need to get the counter updated on the server side. – user606723 Apr 2 '13 at 19:17

Looking at the vendor page under Technical Specifications gives you all the information you need.

The token in question supports both the TOTP and HOTP algorithms. More information on the algorithms can be gleaned from their respective RFCs, RFC-6238 and RFC-4226.

share|improve this answer
If I understand what does TOTP and HOTP means, I would have read the RFC :D – Yousf Apr 2 '13 at 15:30
@Yousf The wikipedia page linked has very simple high-level explanations of the protocols. – Terry Chia Apr 2 '13 at 15:31
Why was this downvoted?.... – Terry Chia Apr 2 '13 at 15:32
I didn't downvote, but I suppose someone didn't like the "RTFM" attitude (which one might read from your answer). – Paŭlo Ebermann Apr 2 '13 at 20:20
I read it as referencing highly authoritative sources. +1 for that. – Marcks Thomas Apr 2 '13 at 22:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.