One-time password (OTP) protocols and implementations (software and hardware)

learn more… | top users | synonyms (1)

2
votes
1answer
72 views

Security implications of reusing unused One-Time Password

Scenario: Login to site (using 2SV). One-Time Password (OTP) is sent to client's device. Client won't finish authentication process. On the next day (let's say after 24h) users logins to site again. ...
2
votes
2answers
94 views

HOTP/similar - how about standard backups of mobile devices?

I was considering adding HOTP as an option to my website (alongside things such as SMSed one time tokens which I already have). But I was considering one issue that HOTP inherently has: Things such ...
0
votes
1answer
133 views

Algorithms for transaction authentication

It's unclear to me how transaction signing and transaction authentication work. Industrial solutions use both symmetric and asymmetric algorithms to compute the signature. What does RSA add the ...
11
votes
4answers
7k views

Does adding two-factor authentication by OTP really make KeePass more secure

KeePass is an application that keeps all your passwords for you in a database. It is primarily protected by a master password and/or keyfile. If the database is properly encrypted with that password ...
3
votes
0answers
21 views

Security concerns for long-lasting single use access tokens with secondary identity verification?

I have an application that has a user type that "returns as needed" over the course of 22 days to complete action items. The application handles sensitive/confidential information, but > 90% of users ...
0
votes
1answer
21 views

How to overcome the risk of account being compromised using OTP when mobile device is stolen

What is the preferred way to provide a "password reset" functionality for an application installed on a mobile device? In mobile applications, generally password reset works by sending OTP to the ...
1
vote
1answer
45 views

Disk encryption with OTP to protect source code

We have to ship a hard- and software prototype to a customer for a first field test. The software is just not ready (protected - too much Python code) for distribution without the possibility, that ...
5
votes
4answers
4k views

One Time Password via Text Message: Possible exploits?

Is there a credible scenario in which the OTP (One Time Password) for online credit card transactions ( specifically for Verified by Visa) can be bypassed? Context: A guy I know was cheated via the ...
2
votes
3answers
62 views

Is using the 2FA secret on the same machine as using the credentials, removing one factor of 2FA?

In other words: Is saving or using the two-factor authentication (2FA) secret on the same machine to generate one-time passwords (OTP), breaking the two-factor authentication (2FA) concept since it's ...
3
votes
0answers
263 views

How is PasswordSafe different from KeePass/OtpKeyProv?

Over at Does adding two-factor authentication by OTP really make KeePass more secure the top answer unmistakably states that KeePass is not made more secure by using an OTP. I told a friend I was ...
0
votes
2answers
89 views

How does a Safenet eToken Pass(hardware token) generates OTP and based on which algorithm? How does authentication takes place against it?

I use hard token to login to a VPN but I don't get the concept behind it.The password is combination of a self generated PIN + OTP generated on eToekn Pass. How do authentication takes place at back ...
9
votes
5answers
2k views

Is there any alternative beside sending One-Time-Password via SMS?

I'm working on one smaller system where it will be required to enter One-Time-Password (OTP, not to be confused with a One-Time-Pad) to download sensitive files which will be delivered to the user. ...
6
votes
4answers
112 views

How can I protect my credit card on sites where 2FA is not an option?

I'm using Visa Express, and sometimes when I'm shopping, the store doesn't support Verified by Visa - so that means that there is no 2FA option. Normally when there is that option, it will force me ...
3
votes
1answer
45 views

Relatively simple OTP code generated by SafeNet MobilePass

I noticed something peculiar while logging into the VPN of the company I work for. I generated a one-time passcode from MobilePass, and the code displayed was “010010”. I captured an image of this ...
1
vote
2answers
451 views

How to store the access token / password reset token in the database?

I have an access code that is sent to users so that they can access the site in one-click. From terms of access it's very similar to the password reset url, so I assume the same assumptions apply. E....
1
vote
2answers
45 views

How do hardware OTPs work - from a developer's perspective?

I've recently stumbled across the Gemalto IDPrime MD series of smartcards which offer PKI and OTP functionality (I know the difference in key management / generation and user oriented usage). Now I ...
2
votes
3answers
89 views

How do hardware OTPs work?

I've recently stumbled across a number of one-time-password (OTP) smartcards in some of the internet shops specialized on cryptographic equipment. Now I know / think to know how OTP works with ...
2
votes
2answers
210 views

Secure copy-paste from phone to computer

Some computers on my university block the keepass application which I use as a password manager. I'm thinking of building a small web application + Android app which lets me securely copy a string ...
-4
votes
1answer
496 views

Why don't we do dual password instead of forgot password?

You can see the link "Forgot Password?" nearby almost all login form. Since passwords are completely protected from outside access, I come up with this question. I accept that the forgot password ...
3
votes
1answer
66 views

Is symmetric encryption with one time pre-shared key secure?

Suppose I have a secure channel between client and server, with proper certificate validation etc (actually, ssh session). I want to establish a secure connection between my own application on a ...
1
vote
1answer
106 views

What are the privacy implications of using Yubico OTP with YubiCloud?

I am considering purchasing Yubikey devices (made by Yubico) to add two-factor authentication when my users ssh to our various servers. I figured I would configure the device to use Yubico OTP with ...
3
votes
1answer
121 views

Relative merits of Yubico OTP vs. OATH-HOTP?

What are the pros and cons of using Yubico OTP vs. OATH-HOTP? They both seem very similar.
5
votes
2answers
380 views

How secure is a password app that stores both the password and two factor secret in one place?

Take for example 1Password, that now can store your password and one time password secret in a single place (your 1Password vault). I know it isn't truly two-factor anymore, but how much better is it ...
1
vote
1answer
54 views

Generation of a shared nonce that cannot be pre computed [closed]

Is there any system out there currently, which can generate a nonce, which all nodes on a distributed network can agree and calculate the same nonce at the same time, but one an attacker cannot pre ...
1
vote
1answer
44 views

How big window is secure and practical with TOTP?

We are using Time-based One-time Password Algorithm (Google Authenticator) in our system. Since we currently don't allow any time window and code validity is just 30 seconds, we are constantly having ...
0
votes
2answers
87 views

What is a good way to generate a one time pad, and is this a good way? [duplicate]

Is there a good/better/best way to generate a one time pad? I would like to only utilize about 40 characters (a-z, 0-9, .,!-). What I have come up with is perhaps not the BEST way, but seems to fill ...
2
votes
2answers
93 views

Is email OTP improving the security for 2 phase authentication?

There has been similar questions before where people say that using some other means (sms, hardware devices, etc.) is a more secure way to provide 2 factor authentication. Provided we don't have an ...
2
votes
1answer
125 views

Using Google Authenticator for SSH sessions

So I have an SSH tunnel which I use with dynamic port forwarding to the alternate http port on the client. For initializing this connection, I'd like to implement an additional verification step, ...
81
votes
6answers
23k views

How secure are the FIDO U2F tokens

Google and Yubico just announced the availability of cryptographic security tokens following the FIDO U2F specification. Is this just another 2FA option, or is this significantly better than solutions ...
16
votes
1answer
1k views

FIDO, U2F Compatibility

I've been following the FIDO standard (a consumer-friendly public-key system similar to SSH key pairs) and it appears that it's close to being complete: both Google and PayPal have been testing it ...
1
vote
1answer
111 views

Signup/Signin with Mobile+PIN

Telegram implements signup/signin with mobile number and a 5-digit one-time password. I believe the flow to be something along the lines of this: Grab the mobile number, generate an OTP, cache it ...
1
vote
2answers
174 views

Password Reset URL forwarding

If a previously registered user clicks on the password reset button during login, I want to send them an email with a reset password link. I have three queries: How to add an expiry date to the ...
3
votes
3answers
290 views

Should LastPass use the YubiKey public identifier as a secret key?

I've just picked up a YubiKey. However, the demo Yubico redirect you to is served over plain HTTP, over which each OTP you generate during the demo is POSTed, enabling you to verify that your key is ...
9
votes
2answers
251 views

What happens if a (google authenticator) one time password QR code is leaked?

When there are QR codes for one time password (OTPs) urls (starting with otpauth://) that are supposed to be looked up in an authenticator app such as Google authenticator, what happens if a user ...
3
votes
1answer
80 views

Using the password, among other values, as key data in two-factor authentication

I'm writing an implementation and a thesis about two-factor authentication, and am currently doing some research. I'm currently looking at an implementation for deterministically generating a ...
2
votes
1answer
120 views

OTP on the same device being used to login

I've seen mobile apps use two factor authentication by sending an SMS to the mobile phone. However, if I've stolen someone's phone, where is the security advantage? I can understand it if it's used in ...
5
votes
2answers
1k views

HOTP with as HMAC hashing algoritme a hash from the SHA-2 family

I'm looking into using a OTP solution. HOTP is a OTP solution that is based on a HMAC with as hashing algorithm SHA-1. The standards defines it this way. But... SHA1 (as we know) has been a ...
3
votes
2answers
314 views

TOTP Resynchronisation

Considering hardware tokens implementing OATH TOTP (c.f. RFC6238), it is common knowledge that the clock in such tokens drift. A token that is not used very often is likely to drift way beyond the ...
1
vote
2answers
452 views

Storing Seed for TOTP

We have a public website for employees which has access to some sensitive company information. To make the login process more secure we want to implement TOTP. The setup and implementation has been ...
1
vote
3answers
469 views

Where is the TOTP secret key stored on client applications?

I'm new to concept of TOTP, but as I understand, 16-character base32-encoded shared secret is stored in the client application(for example Authy, FreeOTP)? This means that if I remove the application, ...
2
votes
1answer
106 views

What happens when authenticating through a phishing attack with FIDO U2F tokens

So I have looked around and haven't found this anywhere. What happens when the response server is a phishing site with FIDO U2F tokens? Basically, if login just fails, I would assume that the user ...
3
votes
4answers
1k views

One-Time-Passwords resist against bruteforce attacks? Immune Alternative?

Does a One-Time-Password like Google Authenticator or YubiKey protect against brute force attacks with unlimited computer power? If not, what algorithems are immune to bruteforce attacks against ...
3
votes
2answers
1k views

Is HMAC-SHA256 and HMAC-SHA512 able to act as drop in replacement for HMAC-SHA1 in HOTP/TOTP?

In RFC 4226, the algorithm for HOTP is described as follow. HOTP(K,C) = Truncate(HMAC-SHA-1(K,C)) TOTP is essentially the same algorithm as HOTP except for the fact that the counter C is ...
4
votes
2answers
281 views

Email for the second factor in 2FA systems

the scenario is in a corporate environment and not connected to internet. The other day I was arguing with my colleague on whether email is good enough to be the second factor in a 2FA system. My ...
4
votes
1answer
123 views

One time password question

Suppose F(X) = (5X) mod 9 is used to generate a one time password. I am supposed to generate the first 8 values using the above formula, starting with the seed value of F(5) Well I know that F(5) = ...
1
vote
0answers
65 views

Time Based Authentication

I need a way of authenticating that a file was generated by a particular machine that has a unique ID and a unique random secret also known to the authenticator, as an added difficulty the file ...
2
votes
1answer
242 views

Lamport OTP system

This might be a stupid question but forgive me. Is the Lamport OTP algorithm different from HOTP and TOTP? How similar or different are they? Thanks in advance
3
votes
4answers
177 views

Are there any two way + two factor authentication systems in use?

My bank, Google etc. use two factor systems where they send me a One Time Password via out of band means. e.g. SMS or an App on my Cellphone or a standalone RSA token generator. This seems good ...
0
votes
3answers
4k views

Is it possible to use one-time passwords for WI-FI?

Is it possible to configure an access point to use one-time passwords for authentication and encryption ?
2
votes
0answers
141 views

Generate secure one-time codes containing information

I need to create a system that allows a user to enter codes to charge an allowance. Embedded in this code should be the amount to charge the allowance. The user would pay for a code which would then ...