One-time password (OTP) protocols and implementations (software and hardware)

learn more… | top users | synonyms (1)

7
votes
2answers
190 views

How secure are the FIDO U2F tokens

Google and Yubico just announced the availability of cryptographic security tokens following the FIDO U2F specification. Is this just another 2FA option, or is this significantly better than solutions ...
-1
votes
1answer
25 views

Can OTP 2FA be reversibly determined?

Please note: I'm not necessarily talking about what happens when one shoulder surfs someone inputting a OTP. I'm fairly confident that it's nearly impossible (or extremely impractical) to guess the ...
2
votes
4answers
72 views

One-Time-Passwords resist against bruteforce attacks? Immune Alternative?

Does a One-Time-Password like Google Authenticator or YubiKey protect against brute force attacks with unlimited computer power? If not, what algorithems are immune to bruteforce attacks against ...
1
vote
1answer
30 views

Verification code generation and expiration

I am trying to implement an application that includes registration, In order to register to the system the user shall enter his organization ID number let's say. To verify the user identity, a ...
0
votes
1answer
84 views

Idea for an algorithm to authenticate users with zero-knowledge-proof [need thoughts/review]

I have an idea for an algorithm. I don't know if I made any mistakes and need some extra thoughts/peer review on it. This would work as an (almost)zero knowledge proof for sending passwords that can ...
2
votes
1answer
173 views

What are the typical ways to generate a One Time Password?

I'm looking for the typical ways to generate a One Time Password. I know about the HOTP and TOPT. But, in my case, the problem is that the "server" only has a display as interface and the ...
0
votes
3answers
97 views

Is it possible to use OTPs for WI-FI?

Is it possible to configure an access point to use OTPs for authentication and encryption ?
1
vote
1answer
45 views

OTP for syncing mobile device

Scenario: a web app with two-factor authentication using username/password and hardware OTP. Once logged into the app, one of the app modules should be used in a tablet or any mobile device without a ...
0
votes
4answers
138 views

Why must every OTP be unique

All OTP systems that I have observed, send a new OTP every time a user requests for an OTP. (for example whatsapp) Only the latest OTP is valid and an OTP can only be used for X hours. I am wondering ...
0
votes
2answers
71 views

Are there any flaws in my design for a paper-based OTP grid?

I'm trying to implement two-factor authentication on the cheap for a website of mine. My bank uses this sort of grid-based OTP system, so I wanted to emulate it in my application: Cards are ...
0
votes
1answer
89 views

Where is the TOTP secret key stored on client applications?

I'm new to concept of TOTP, but as I understand, 16-character base32-encoded shared secret is stored in the client application(for example Authy, FreeOTP)? This means that if I remove the application, ...
5
votes
0answers
96 views

Google Authenticator Error on Reboot

I have set up an SSH server to accept only login using codes generated by Google Authenticator (I have disabled all other forms of authentication on that port). After having rebooted my remote ...
0
votes
0answers
43 views

Algorithm to Transaction Data Signing

Transaction Data Signing I need an idea to develop a very secure algorithm to authenticate online operations using PHP in the server and an Android app in the user's device. What is the idea? The ...
0
votes
1answer
60 views

“Reverse” approach to one-time key generation

Suppose we have a master key, and we want to encrypt some file(s). We then generate one-time key for that file, use it to encrypt file contents, and finally encrypt one-time key using master key (with ...
3
votes
1answer
174 views

How do OTP USB sticks work?

I just discovered the YubiKey NEO which seems like a pretty awesome device for maintaining security for a variety of different things including computer login, SSH private keys, GPG private keys, and ...
0
votes
0answers
109 views

KeePass OTP plugin circumvents inbuilt protections?

I have read the question on HOTP implementation in KeePass HERE. This question is however on the other newer plugin KeeChallenge. According to the documentation, the a secret is encrypted and can ...
0
votes
1answer
131 views

Storage of the One Time Password Seed

I'm a student and I'm working on an OTP authentication systeme based on OATH using smart phones as tokens for the clients. My problem is the protection the OTP seed at both client and validation ...
10
votes
2answers
708 views

LastPass Grid Authentication vs Google Authenticator which one is more secure?

[Being a LastPass user] recently I moved to Google Authenticator instead of using Grid Authentication as a 2-factor security. For me, finding and filling letters from such a dense matrix is a rather ...
1
vote
1answer
46 views

Issues of using HOTP w/ iteration window

I am using HOTP to generate OTP to validate a request, in order to prevent replay attacks. I'm thinking about using a window of 10 (or so) iterations to accommodate a possible mismatch in the counter ...
1
vote
0answers
37 views

Is there a TOTP variant that does not require the user to type in a code? [closed]

We're considering a 2 factor TOTP solution on a mobile phone. However, it would be much easier for the user to somehow send the OTP to the server by pushing a button, rather than manually typing in a ...
2
votes
0answers
439 views

FIDO, U2F Compatibility

I've been following the FIDO standard (a consumer-friendly public-key system similar to SSH key pairs) and it appears that it's close to being complete: both Google and PayPal have been testing it ...
6
votes
1answer
203 views

Why does my bank bother asking basic personal questions to log in to online banking?

To log into my online banking, I have to answer a basic personal question such as "What is your mother's maiden name" or "What is your grandfather's middle name", as well as enter a one-time code from ...
-1
votes
1answer
218 views

Why don't we do dual password instead of forgot password?

You can see a link Forgot Password? nearby almost all login form. As I mentioned in question, Since passwords are completely protected from outside access unless owner reveal, I come up with this ...
1
vote
1answer
151 views

Are there any secure ways to store the secret key used in a TOTP scheme?

I'm writing a little webapp that demonstrates 2 factor authentication. I'm using the TOTP protocol as described in RFC 6238. In our scheme, we are storing, in addition to a b-crypted password hash ...
2
votes
2answers
566 views

How to write a rock solid TOTP implementation?

I am currently writing a TOTP implementation in PHP (but this applies to other languages as well) and of course want it to be as secure as possible, what should be considered? After reading the ...
2
votes
2answers
66 views

HOTP/similar - how about standard backups of mobile devices?

I was considering adding HOTP as an option to my website (alongside things such as SMSed one time tokens which I already have). But I was considering one issue that HOTP inherently has: Things such ...
3
votes
1answer
119 views

Should an administrator be able to turn off TFA for a user

We use Google Authenticator and SMS for two factor authentication. Should we allow the administrators of the site to turn off TFA for users? Google Auth uses SMS as backup option but SMS does not ...
1
vote
2answers
528 views

Is HMAC-SHA256 and HMAC-SHA512 able to act as drop in replacement for HMAC-SHA1 in HOTP/TOTP?

In RFC 4226, the algorithm for HOTP is described as follow. HOTP(K,C) = Truncate(HMAC-SHA-1(K,C)) TOTP is essentially the same algorithm as HOTP except for the fact that the counter C is ...
3
votes
1answer
150 views

S/Key as an alternative to UNIX passwords

There is this password system called S/Key I saw on the Internet. Can someone give me a brief description about S/Key and how it works? Can S/Key be an alternative solution to the UNIX password ...
0
votes
2answers
944 views

Google Authenticator - Counter Based [duplicate]

I'm trying to understand How google authenticator - counter based work. I have tried googling around finding a demo or at least how this work. I understand its a one time password but not like TOTP. I ...
0
votes
1answer
178 views

Storing Seed for TOTP

We have a public website for employees which has access to some sensitive company information. To make the login process more secure we want to implement TOTP. The setup and implementation has been ...
4
votes
2answers
533 views

Is OATH TOTP and / or Google Authenticator vulnerable if an attacker has (N) previous codes?

I'm not much of a ipsec initiate, so this is a bit over my head ... but I'm always willing to learn more. Are there any known attacks against OATH TOTP (Google Authenticator's / Authy's algorithm) if ...
5
votes
2answers
3k views

Does adding two-factor authentication by OTP really make KeePass more secure

KeePass is an application that keeps all your passwords for you in a database. It is primarily protected by a master password and/or keyfile. If the database is properly encrypted with that password ...
0
votes
2answers
190 views

Using authentication only one time passwords [duplicate]

I would be interested in advice. Imagine a authentication mechanism where users are authenticated ONLY using some code (e.g., one time password) which they receive (say as SMS) on their mobile phone? ...
10
votes
4answers
676 views

What is the use of the “secret” displayed when setting up 2 Factor Authentication?

What is the purpose of the "secret" that is displayed when you take the picture of the QR code to set up 2 Factor Authentication on a non-Google site? Why would you need it? If you save it, doesn't ...
61
votes
3answers
17k views

How does Google Authenticator work?

Google Authenticator is an alternative to SMS for 2Step verification, installing an app on Android where the codes will be sent. It works without any connectivity; it even works on plane mode. This ...
1
vote
1answer
150 views

What manufacturers create OATH HOTP cards now that InCard Technologies is no longer in business?

I purchased the following OAUTH HOTP card from Verisign. I'm intrigued by the security possibilities that this form factor provides and what customizations to the circuit logic are possible. On ...
2
votes
2answers
138 views

Client code tampering detection

I have a server in a trusted environment. This server handles requests from clients in an a non-trusted environment. I'd like to authenticate each request and to know if the client code has been ...
2
votes
1answer
361 views

HOTP with as HMAC hashing algoritme a hash from the SHA-2 family

I'm looking into using a OTP solution. HOTP is a OTP solution that is based on a HMAC with as hashing algorithm SHA-1. The standards defines it this way. But... SHA1 (as we know) has been a ...
1
vote
1answer
365 views

What is more secure for voice and SMS OTP: A random number or generated similar to HOTP?

Many providers are creating OTP authentication for their sign in. However I noticed that all the voice and SMS OTPs I've come across are a series of 6 digits... similar to the HOTP RFC Standard ...
10
votes
3answers
1k views

What is the risk and mitigation of accidentally typing a YubiKey password in an open forum?

I have a YubiKey in my laptop (for testing) and accidentally broadcast my YubiKey password out to the Internet. Since this is only a test key, and has no access to anything of value, here are some ...
2
votes
2answers
559 views

Security evaluation of Vasco's Digipass Mobile SDK for OTP?

Has anybody worked with or integrated the Vasco Digipass Mobile SDK OTP generator into a custom mobile app for iOS devices? I am currently performing a full security evaluation of the solution ...
1
vote
2answers
349 views

Can I use hardware token OTP to stop piracy?

Our firm sells an offline desktop (.exe) software, we are thinking of using OTP (from hardware token like in internet banking) to stop people from copying the software without permission. Basically, ...
2
votes
1answer
511 views

Is Dual Factor possible during boot with whole disk encryption on Mac FileVault 2

Mac FileVault 2 is the default disk encryption for newer Macs that occurs in the EFI pre-boot phase. The challenge here is that most smartcard drivers are loaded after the OS loads. Is anyone aware ...
2
votes
3answers
515 views

What are the main weaknesses of mobile software based OTP generators?

What are the main weaknesses of Software based OTP generators like Vasco's DigiPass for Mobile?
5
votes
2answers
788 views

How to store OTP seed securely at the validating server

'Everyone' knows when storing passwords in a database this should be done securely for example by using salts and an appropriate hashing algorithm. Most OTP (One Time Password) solutions are based on ...
4
votes
4answers
713 views

SMS Authentication: random OTP or a cryptographic one

I'm adding two-factor authentication using SMS to enhance an existing login process. Since I'm not working with physical tokens, I was wondering what is considered the safest: Sending random 8 ...
7
votes
2answers
600 views

Replacement for One Time Passwords (OTP)

OTP may known as new generation of password security techniques, but I want to know does it still safe enough after several years of appearance or it will deprecate soon? & what would be the ...
2
votes
3answers
254 views

Why would it be a good idea for someone to get or not to get a Yubi key [closed]

In what uses would it be smart to get a Yubi key?
1
vote
1answer
98 views

How to detect suspicious tokens collected by a hacker

I previously asked a question here What's the use of adding a challenge in the otp algorithm? Let's suppose that a hacker has succeeded to collect tokens. Is there a way to detect suspicious ...