Return to Question

This question is about OTP codes that are used in flows like

• Email verification
• SMS 2fa

Usually, when you send an OTP, you want to give the user an option to resend the OTP.

Assuming the following protections are in place:

1. Limit the number of attempts to enter the right code (defend against brute force)
2. Limit the number of attempts to resend the code in a certain time window (defend against spamming the recipient)
3. Code has short expiration

Is there a reason to generate new OTP code on each resend attempt  ? If so, is it really needed to revoke the previous codes once a resend has been made  ?

I have seen services, Facebook for example, who send you the same code in the resend attempts. In terms of usability, it's better to send the same code so that if the first code did arrive late the user will not be confused about which code they should enter. But I am not sure if there are any practical security implications of that.

This question is about OTP codes that are used in flows like

• Email verification
• SMS 2fa

Usually, when you send an OTP, you want to give the user an option to resend the OTP.

Assuming the following protections are in place:

1. Limit the number of attempts to enter the right code (defend against brute force)
2. Limit the number of attempts to resend the code in a certain time window (defend against spamming the recipient)
3. Code has short expiration

Is there a reason to generate new OTP code on each resend attempt? If so, is it really needed to revoke the previous codes once a resend has been made?

I have seen services, Facebook for example, who send you the same code in the resend attempts. In terms of usability, it's better to send the same code so that if the first code did arrive late the user will not be confused about which code they should enter. But I am not sure if there are any practical security implications of that.

This question is about OTP codes that are used in flows like

• Email verification
• SMS 2fa

Usually, when you send an OTP, you want to give the user an option to resend the OTP.

Assuming the following protections are in place:

1. Give the user X attempts to enter the right code (defend against brute force)
2. Give the user X attempts to resend the code in a time window (defend against spamming the recipient)

Is there a reason to generate new OTP code on each resend attempt ? If so, is it really needed to revoke the previous codes once a resend has been made ?

I have seen services, Facebook for example, who send you the same code in the resend attempts. In terms of usability, it's better to send the same code so that if the first code did arrive late the user will not be confused about which code they should enter. But I am not sure if there are any practical security implications of that.

This question is about OTP codes that are used in flows like

• Email verification
• SMS 2fa

Usually, when you send an OTP, you want to give the user an option to resend the OTP.

Assuming the following protections are in place:

1. Limit the number of attempts to enter the right code (defend against brute force)
2. Limit the number of attempts to resend the code in a certain time window (defend against spamming the recipient)
3. Code has short expiration

Is there a reason to generate new OTP code on each resend attempt ? If so, is it really needed to revoke the previous codes once a resend has been made ?

I have seen services, Facebook for example, who send you the same code in the resend attempts. In terms of usability, it's better to send the same code so that if the first code did arrive late the user will not be confused about which code they should enter. But I am not sure if there are any practical security implications of that.

This question is about OTP codes that are used in flows like

• Email verification
• SMS 2fa

Usually, when you send an OTP, you want to give the user an option to resend the OTP.

Assuming the following protections are in place:

1. Don't let the user enter wrong code more than X times (defend against brute force)
2. Don't let the user do too many resend attempts in a specific time window (defend against spamming the recipient)

Is there a reason to generate new OTP code on each resend attempt ? If so, is it really needed to revoke the previous codes once a resend has been made ?

I have seen services, Facebook for example, who send you the same code in the resend attempts. In terms of usability, it's better to send the same code so that if the first code did arrive late the user will not be confused about which code they should enter. But I am not sure if there are any practical security implications of that.

This question is about OTP codes that are used in flows like

• Email verification
• SMS 2fa

Usually, when you send an OTP, you want to give the user an option to resend the OTP.

Assuming the following protections are in place:

1. Give the user X attempts to enter the right code (defend against brute force)
2. Give the user X attempts to resend the code in a time window (defend against spamming the recipient)

Is there a reason to generate new OTP code on each resend attempt ? If so, is it really needed to revoke the previous codes once a resend has been made ?

I have seen services, Facebook for example, who send you the same code in the resend attempts. In terms of usability, it's better to send the same code so that if the first code did arrive late the user will not be confused about which code they should enter. But I am not sure if there are any practical security implications of that.