One-time password (OTP) protocols and implementations (software and hardware)
1
vote
1answer
58 views
What manufacturers create OATH HOTP cards now that InCard Technologies is no longer in business?
I purchased the following OAUTH HOTP card from Verisign. I'm intrigued by the security possibilities that this form factor provides and what customizations to the circuit logic are possible.
On ...
2
votes
2answers
53 views
Client code tampering detection
I have a server in a trusted environment. This server handles requests from clients in an a non-trusted environment. I'd like to authenticate each request and to know if the client code has been ...
2
votes
1answer
93 views
HOTP with as HMAC hashing algoritme a hash from the SHA-2 family
I'm looking into using a OTP solution.
HOTP is a OTP solution that is based on a HMAC with as hashing algorithm SHA-1. The standards defines it this way.
But... SHA1 (as we know) has been a ...
1
vote
1answer
105 views
What is more secure for voice and SMS OTP: A random number or generated similar to HOTP?
Many providers are creating OTP authentication for their sign in. However I noticed that all the voice and SMS OTPs I've come across are a series of 6 digits... similar to the HOTP RFC Standard ...
7
votes
2answers
254 views
What is the risk and mitigation of accidentally typing a YubiKey password in an open forum?
I have a YubiKey in my laptop (for testing) and accidentally broadcast my YubiKey password out to the Internet. Since this is only a test key, and has no access to anything of value, here are some ...
-1
votes
1answer
83 views
Security evaluation of Vasco's Digipass Mobile SDK for OTP?
Has anybody worked with or integrated the Vasco Digipass Mobile SDK OTP generator into a custom mobile app for iOS devices?
I am currently performing a full security evaluation of the solution ...
1
vote
2answers
210 views
Can I use hardware token OTP to stop piracy?
Our firm sells an offline desktop (.exe) software, we are thinking of using OTP (from hardware token like in internet banking) to stop people from copying the software without permission. Basically, ...
2
votes
1answer
193 views
Is Dual Factor possible during boot with whole disk encryption on Mac FileVault 2
Mac FileVault 2 is the default disk encryption for newer Macs that occurs in the EFI pre-boot phase. The challenge here is that most smartcard drivers are loaded after the OS loads.
Is anyone aware ...
1
vote
3answers
158 views
What are the main weaknesses of mobile software based OTP generators?
What are the main weaknesses of Software based OTP generators like Vasco's DigiPass for Mobile?
4
votes
2answers
178 views
How to store OTP seed securely at the validating server
'Everyone' knows when storing passwords in a database this should be done securely for example by using salts and an appropriate hashing algorithm.
Most OTP (One Time Password) solutions are based on ...
3
votes
4answers
289 views
SMS Authentication: random OTP or a cryptographic one
I'm adding two-factor authentication using SMS to enhance an existing login process. Since I'm not working with physical tokens, I was wondering what is considered the safest:
Sending random 8 ...
7
votes
2answers
328 views
Replacement for One Time Passwords (OTP)
OTP may known as new generation of password security techniques, but I want to know does it still safe enough after several years of appearance or it will deprecate soon? & what would be the ...
2
votes
3answers
184 views
Why would it be a good idea for someone to get or not to get a Yubi key [closed]
In what uses would it be smart to get a Yubi key?
1
vote
1answer
89 views
How to detect suspicious tokens collected by a hacker
I previously asked a question here What's the use of adding a challenge in the otp algorithm?
Let's suppose that a hacker has succeeded to collect tokens. Is there a way to detect suspicious ...
5
votes
1answer
152 views
What's the use of adding a challenge to a one time password algorithm?
In these YouTube videos Challenge-Respond Mode and Sign Mode the customer enters a challenge into the CAP device before generating a one time password. Why not just generate the one time password ...
-1
votes
1answer
166 views
Number of time steps in TOTP [closed]
I am implementing TOTP in JAVA.Formula for number of time steps is T = (Current Unix time - T0) รท X.I have taken Current Unix time:long unixTime = System.currentTimeMillis()/1000L(1335246034) and T0 ...
3
votes
1answer
657 views
Please explain Time-step in Time-Based One-Time Password Algorithm
I am studying about OTPs (One Time Passwords). I have gone through all the methods: HOTP (HMAC-based One Time Password), TOTP (Time-based One Time Password)
I have no issues with HOTP. But according ...
3
votes
3answers
591 views
Mobile OTP - Secure?
I came across Mobile-OTP, "a de facto standard for strong mobile authentication" (http://motp.sourceforge.net). The developers claim that it is very secure etc.
Reading through the implementation, I ...
