Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

(Note: I am not actually planning to do this. This question is strictly theoretical.)

TOTP is commonly used as the second factor in Two Factor Authentication. It is an open standard with available implementations in multiple programming languages and platforms. There is an easy to use client app for both iOS and Android in the form of the Google Authenticator app.

Is there any fundamental security issues with using TOTP as a single factor authentication method in place of passwords? Ignoring of course that single factor authentication really should be discouraged.

share|improve this question
    
No way. What it's easier, to give your password or to lose your phone/key fob/whatever token? If you follow best practices about passwords, it is practically impossible to guess. However if you use just "something you have", if that device is lost, stolen, etc, who gets it have full access without further restrictions. –  yzT Jun 10 '13 at 14:25

2 Answers 2

up vote 5 down vote accepted

I have done some thinking on this topic and I would like to present my ideas. Feel free to draw your own conclusions.

Facts

  1. The secret used for the TOTP algorithm is a 80-bit randomly generated key encoded with base32. This probably more secure than the passwords most people use.

  2. The secret key is usually presented in the form of a QR-code to be scanned by the Authenticator app. Alternatively, some services also provide the base32 encoded secret key for manual input.

  3. In an Android device, the secret is stored unencrypted in an SQLi database file. The SQLi file is located at /data/data/com.google.android.apps.authenticator2/databases/databases. However, this file isn't accessible to any application other than the Authenticator app itself. Obviously this does not apply to a rooted device. I do not have a rooted iOS device so I am unable to comment on the specifics of the iOS version of the Google Authenticator app.

My conclusions

In my opinion, there are some benefits and drawbacks to replacing passwords with a TOTP authentication solution.

Benefits

  1. Assuming that the Android device in question is not rooted, no other application besides the Authenticator app can access the secret stored in the database. This removes a very large risk of malware hijacking the secret used for authentication. Any keyloggers/screenloggers will only be able to grab the temporary password that expires in 60 seconds. This is a very small window unless you are the focus of a very targeted attack.

  2. Using TOTP removes the possibility of an attacker performing an online brute-force attack against the service. The window of opportunity is simply too short.

  3. To some people, this is a good tradeoff between security and convenience. Most people I know carry a smartphone around 24/7. Authentication is a simple matter of accessing the app and keying in 6 digits. To some people, this might be easier than having to remember relatively strong passwords or carrying around a password database.

Drawbacks

  1. A database compromise means having to reset the secret. This can be really troublesome for the users.

  2. A user losing his/her smartphone means losing access to the service.

This is quite interesting to think about. However, in the real world you should obviously use regular passwords and one-time passwords together for 2FA.

share|improve this answer

Anybody owning the seed can generate the same sequence of tokens/passwords. I think this is insecure enough to not allow this as single login token.

share|improve this answer
5  
As a single factor it is no different from a password. The seed (key) is longer than most people's passwords, so that could provide some level of assurance on the level of entropy, but as Uwe points out, just like how with a password anyone who knows the password can get in, in this case anyone who knows the seed can get in. if you have implemented it to this stage, what holds you back from doing it right as 2 factors? –  Rod MacPherson Jun 10 '13 at 12:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.