Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was considering adding HOTP as an option to my website (alongside things such as SMSed one time tokens which I already have). But I was considering one issue that HOTP inherently has:

Things such as the iPhone usually get backed up along with all app data. That would mean, say I'm using Authy to generate my OTP tokens, the secret keys from within Authy would get included in such backups as well. Well, the entire purpose of OTP is so that information on the computer is not enough to break into an account and you need that second factor just in case something such as malware gets onto the computer (if I understood properly). But this backup means, if I have access to your computer, I can get your password through conventional manners such as a keylogger, but I can also look through your mobile phone backups for the HOTP secret key and without your phone, successfully log in.

So what's keeping people from doing that, and why should I also offer HOTP or is it better for me to still just stick with only SMSed tokens?

share|improve this question
add comment

2 Answers

Some phones send SMS messages to a computer in realtime when nearby it (Samsung has a little thing for their android phones that does this, or did), and if the phone is plugged into a computer and supporting Hayes modem commands, those can read text messages in realtime too.

Really, what OTPs get you is protection against people guessing passwords, though they are sometimes helpful with stolen ones too. That said, TOTP would be better for this given that it is ephemeral and thus the chances of getting it right don't increase as the number of attempts do. The HOTP is really not much better than a password consisting of the key and counter (in my opinion), except that it effectively comes with its own challenge auth for anti-replayability.

If you need to be secure against people stealing the tokens from phone backups or whatever, you really should issue hardware tokens.

share|improve this answer
add comment

SMS and and smartphone apps are vulnarable to different attacks. I would not call SMS a secure method to transport a one time password. As Falcon was pointing out: If you really want to do two factor authentication you should use a second factor that can not be sniffed and can not be copied. The first is not valid for SMS and the second is not valid for smartphone apps. So for a real 2FA you really should use a not connected piece of hardware.

But nevertheless - security is shades of grey. So sending an SMS or using a smartphone app (no matter if HOTP, TOTP or mOTP) in addition to the password is better than only having the password. You just need to be aware of "how much better" it is.

Having a smartphone app has some advantages over sending SMS: 1. you do not have any SMS costs 2. you will be also able to authenticate, even if you have no GSM service (like in data centers with big walls or under the earth). Of course SMS provides an easier registration process for the end user than installing the App and sharing the HMAC-key with the server.

So providing HOTP and SMS is primarily a convenience for the end user.

Kind regards Cornelius

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.