One-time password (OTP) protocols and implementations (software and hardware)

learn more… | top users | synonyms (1)

106
votes
3answers
39k views

How does Google Authenticator work?

Google Authenticator is an alternative to SMS for 2Step verification, installing an app on Android where the codes will be sent. It works without any connectivity; it even works on plane mode. This ...
80
votes
6answers
22k views

How secure are the FIDO U2F tokens

Google and Yubico just announced the availability of cryptographic security tokens following the FIDO U2F specification. Is this just another 2FA option, or is this significantly better than solutions ...
16
votes
1answer
1k views

FIDO, U2F Compatibility

I've been following the FIDO standard (a consumer-friendly public-key system similar to SSH key pairs) and it appears that it's close to being complete: both Google and PayPal have been testing it ...
12
votes
4answers
1k views

What is the use of the “secret” displayed when setting up 2 Factor Authentication?

What is the purpose of the "secret" that is displayed when you take the picture of the QR code to set up 2 Factor Authentication on a non-Google site? Why would you need it? If you save it, doesn't ...
12
votes
1answer
889 views

Why is the truncate function for HMAC one time passwords so complicated?

I've been reading through RFC4226 as part of some research and I was wondering why the function to truncate the HMAC was so complicated. As far as I understand it, the last 4 bits of the HMAC define ...
12
votes
3answers
2k views

What is the risk and mitigation of accidentally typing a YubiKey password in an open forum?

I have a YubiKey in my laptop (for testing) and accidentally broadcast my YubiKey password out to the Internet. Since this is only a test key, and has no access to anything of value, here are some ...
11
votes
4answers
7k views

Does adding two-factor authentication by OTP really make KeePass more secure

KeePass is an application that keeps all your passwords for you in a database. It is primarily protected by a master password and/or keyfile. If the database is properly encrypted with that password ...
10
votes
2answers
3k views

LastPass Grid Authentication vs Google Authenticator which one is more secure?

[Being a LastPass user] recently I moved to Google Authenticator instead of using Grid Authentication as a 2-factor security. For me, finding and filling letters from such a dense matrix is a rather ...
10
votes
1answer
3k views

What are the differences between the U2F and UAF FIDO authentication standards?

Google recently announced support for Universal 2nd Factor (U2F) authentication in Chrome and started allowing that authentication mechanism to be used for 2-factor authentication across their various ...
9
votes
5answers
2k views

Is there any alternative beside sending One-Time-Password via SMS?

I'm working on one smaller system where it will be required to enter One-Time-Password (OTP, not to be confused with a One-Time-Pad) to download sensitive files which will be delivered to the user. ...
9
votes
2answers
251 views

What happens if a (google authenticator) one time password QR code is leaked?

When there are QR codes for one time password (OTPs) urls (starting with otpauth://) that are supposed to be looked up in an authenticator app such as Google authenticator, what happens if a user ...
9
votes
2answers
3k views

How to store OTP seed securely at the validating server

'Everyone' knows when storing passwords in a database this should be done securely for example by using salts and an appropriate hashing algorithm. Most OTP (One Time Password) solutions are based on ...
8
votes
2answers
973 views

Replacement for One Time Passwords (OTP)

OTP may known as new generation of password security techniques, but I want to know does it still safe enough after several years of appearance or it will deprecate soon? & what would be the ...
6
votes
4answers
112 views

How can I protect my credit card on sites where 2FA is not an option?

I'm using Visa Express, and sometimes when I'm shopping, the store doesn't support Verified by Visa - so that means that there is no 2FA option. Normally when there is that option, it will force me ...
6
votes
1answer
285 views

What's the use of adding a challenge to a one time password algorithm?

In these YouTube videos Challenge-Respond Mode and Sign Mode the customer enters a challenge into the CAP device before generating a one time password. Why not just generate the one time password ...
6
votes
1answer
410 views

Why does my bank bother asking basic personal questions to log in to online banking?

To log into my online banking, I have to answer a basic personal question such as "What is your mother's maiden name" or "What is your grandfather's middle name", as well as enter a one-time code from ...
5
votes
2answers
1k views

HOTP with as HMAC hashing algoritme a hash from the SHA-2 family

I'm looking into using a OTP solution. HOTP is a OTP solution that is based on a HMAC with as hashing algorithm SHA-1. The standards defines it this way. But... SHA1 (as we know) has been a ...
5
votes
4answers
4k views

One Time Password via Text Message: Possible exploits?

Is there a credible scenario in which the OTP (One Time Password) for online credit card transactions ( specifically for Verified by Visa) can be bypassed? Context: A guy I know was cheated via the ...
5
votes
2answers
379 views

How secure is a password app that stores both the password and two factor secret in one place?

Take for example 1Password, that now can store your password and one time password secret in a single place (your 1Password vault). I know it isn't truly two-factor anymore, but how much better is it ...
4
votes
2answers
1k views

Is OATH TOTP and / or Google Authenticator vulnerable if an attacker has (N) previous codes?

I'm not much of a ipsec initiate, so this is a bit over my head ... but I'm always willing to learn more. Are there any known attacks against OATH TOTP (Google Authenticator's / Authy's algorithm) if ...
4
votes
4answers
2k views

SMS Authentication: random OTP or a cryptographic one

I'm adding two-factor authentication using SMS to enhance an existing login process. Since I'm not working with physical tokens, I was wondering what is considered the safest: Sending random 8 ...
4
votes
2answers
280 views

Email for the second factor in 2FA systems

the scenario is in a corporate environment and not connected to internet. The other day I was arguing with my colleague on whether email is good enough to be the second factor in a 2FA system. My ...
4
votes
1answer
123 views

One time password question

Suppose F(X) = (5X) mod 9 is used to generate a one time password. I am supposed to generate the first 8 values using the above formula, starting with the seed value of F(5) Well I know that F(5) = ...
4
votes
1answer
242 views

Google Authenticator Error on Reboot

I have set up an SSH server to accept only login using codes generated by Google Authenticator (I have disabled all other forms of authentication on that port). After having rebooted my remote machine,...
4
votes
1answer
1k views

How do OTP USB sticks work?

I just discovered the YubiKey NEO which seems like a pretty awesome device for maintaining security for a variety of different things including computer login, SSH private keys, GPG private keys, and ...
3
votes
1answer
66 views

Is symmetric encryption with one time pre-shared key secure?

Suppose I have a secure channel between client and server, with proper certificate validation etc (actually, ssh session). I want to establish a secure connection between my own application on a ...
3
votes
4answers
177 views

Are there any two way + two factor authentication systems in use?

My bank, Google etc. use two factor systems where they send me a One Time Password via out of band means. e.g. SMS or an App on my Cellphone or a standalone RSA token generator. This seems good ...
3
votes
1answer
4k views

Please explain Time-step in Time-Based One-Time Password Algorithm

I am studying about OTPs (One Time Passwords). I have gone through all the methods: HOTP (HMAC-based One Time Password), TOTP (Time-based One Time Password) I have no issues with HOTP. But according ...
3
votes
3answers
2k views

Mobile OTP - Secure?

I came across Mobile-OTP, "a de facto standard for strong mobile authentication" (http://motp.sourceforge.net). The developers claim that it is very secure etc. Reading through the implementation, I ...
3
votes
2answers
1k views

Is HMAC-SHA256 and HMAC-SHA512 able to act as drop in replacement for HMAC-SHA1 in HOTP/TOTP?

In RFC 4226, the algorithm for HOTP is described as follow. HOTP(K,C) = Truncate(HMAC-SHA-1(K,C)) TOTP is essentially the same algorithm as HOTP except for the fact that the counter C is ...
3
votes
4answers
1k views

One-Time-Passwords resist against bruteforce attacks? Immune Alternative?

Does a One-Time-Password like Google Authenticator or YubiKey protect against brute force attacks with unlimited computer power? If not, what algorithems are immune to bruteforce attacks against ...
3
votes
1answer
145 views

Should an administrator be able to turn off TFA for a user

We use Google Authenticator and SMS for two factor authentication. Should we allow the administrators of the site to turn off TFA for users? Google Auth uses SMS as backup option but SMS does not ...
3
votes
1answer
199 views

S/Key as an alternative to UNIX passwords

There is this password system called S/Key I saw on the Internet. Can someone give me a brief description about S/Key and how it works? Can S/Key be an alternative solution to the UNIX password system?...
3
votes
1answer
1k views

Is Dual Factor possible during boot with whole disk encryption on Mac FileVault 2

Mac FileVault 2 is the default disk encryption for newer Macs that occurs in the EFI pre-boot phase. The challenge here is that most smartcard drivers are loaded after the OS loads. Is anyone aware ...
3
votes
3answers
289 views

Should LastPass use the YubiKey public identifier as a secret key?

I've just picked up a YubiKey. However, the demo Yubico redirect you to is served over plain HTTP, over which each OTP you generate during the demo is POSTed, enabling you to verify that your key is ...
3
votes
1answer
620 views

Are there any secure ways to store the secret key used in a TOTP scheme?

I'm writing a little webapp that demonstrates 2 factor authentication. I'm using the TOTP protocol as described in RFC 6238. In our scheme, we are storing, in addition to a b-crypted password hash ...
3
votes
1answer
120 views

Relative merits of Yubico OTP vs. OATH-HOTP?

What are the pros and cons of using Yubico OTP vs. OATH-HOTP? They both seem very similar.
3
votes
1answer
80 views

Using the password, among other values, as key data in two-factor authentication

I'm writing an implementation and a thesis about two-factor authentication, and am currently doing some research. I'm currently looking at an implementation for deterministically generating a ...
3
votes
1answer
45 views

Relatively simple OTP code generated by SafeNet MobilePass

I noticed something peculiar while logging into the VPN of the company I work for. I generated a one-time passcode from MobilePass, and the code displayed was “010010”. I captured an image of this ...
3
votes
2answers
312 views

TOTP Resynchronisation

Considering hardware tokens implementing OATH TOTP (c.f. RFC6238), it is common knowledge that the clock in such tokens drift. A token that is not used very often is likely to drift way beyond the ...
3
votes
2answers
1k views

Security evaluation of Vasco's Digipass Mobile SDK for OTP?

Has anybody worked with or integrated the Vasco Digipass Mobile SDK OTP generator into a custom mobile app for iOS devices? I am currently performing a full security evaluation of the solution (end-...
3
votes
0answers
21 views

Security concerns for long-lasting single use access tokens with secondary identity verification?

I have an application that has a user type that "returns as needed" over the course of 22 days to complete action items. The application handles sensitive/confidential information, but > 90% of users ...
3
votes
0answers
262 views

How is PasswordSafe different from KeePass/OtpKeyProv?

Over at Does adding two-factor authentication by OTP really make KeePass more secure the top answer unmistakably states that KeePass is not made more secure by using an OTP. I told a friend I was ...
2
votes
3answers
88 views

How do hardware OTPs work?

I've recently stumbled across a number of one-time-password (OTP) smartcards in some of the internet shops specialized on cryptographic equipment. Now I know / think to know how OTP works with ...
2
votes
2answers
93 views

Is email OTP improving the security for 2 phase authentication?

There has been similar questions before where people say that using some other means (sms, hardware devices, etc.) is a more secure way to provide 2 factor authentication. Provided we don't have an ...
2
votes
3answers
1k views

What are the main weaknesses of mobile software based OTP generators?

What are the main weaknesses of Software based OTP generators like Vasco's DigiPass for Mobile?
2
votes
3answers
294 views

Why would it be a good idea for someone to get or not to get a Yubi key [closed]

In what uses would it be smart to get a Yubi key?
2
votes
3answers
62 views

Is using the 2FA secret on the same machine as using the credentials, removing one factor of 2FA?

In other words: Is saving or using the two-factor authentication (2FA) secret on the same machine to generate one-time passwords (OTP), breaking the two-factor authentication (2FA) concept since it's ...
2
votes
2answers
314 views

Client code tampering detection

I have a server in a trusted environment. This server handles requests from clients in an a non-trusted environment. I'd like to authenticate each request and to know if the client code has been ...
2
votes
1answer
71 views

Security implications of reusing unused One-Time Password

Scenario: Login to site (using 2SV). One-Time Password (OTP) is sent to client's device. Client won't finish authentication process. On the next day (let's say after 24h) users logins to site again. ...