5

This question is about OTP codes that are used in flows like

  • Email verification
  • SMS 2fa

Usually, when you send an OTP, you want to give the user an option to resend the OTP.

Assuming the following protections are in place:

  1. Limit the number of attempts to enter the right code (defend against brute force)
  2. Limit the number of attempts to resend the code in a certain time window (defend against spamming the recipient)
  3. Code has short expiration

Is there a reason to generate new OTP code on each resend attempt? If so, is it really needed to revoke the previous codes once a resend has been made?

I have seen services, Facebook for example, who send you the same code in the resend attempts. In terms of usability, it's better to send the same code so that if the first code did arrive late the user will not be confused about which code they should enter. But I am not sure if there are any practical security implications of that.

Improve this question
1
  • 2
    if eve can get it once, her getting it many times won't be any worse.
    – dandavis
    Commented Dec 19, 2019 at 19:24

1 Answer 1

Reset to default
5

Limit the number of attempts to resend the code

This is the problem that needs solving. It is not a good idea to limit resend attempts. If someone needs to request a resend, how do you decide how many is ok? If there is a delay in receiving the OTPs, how does the user figure out which one is the most recent? There is a big UX issue here.

Because it's not a good idea to limit resends, you need to let the code survive a little while else you expose the user to a permanent DoS attack where someone just automates OTP requests which invalidate all codes sent previously, no matter how recently.

So to limit resends, you create a UX problem that is solved by simply letting OTPs live a little while. Once the OTP is used successfully, you invalidate it.

So, no, there is no security reason to change the OTP with every request. There are no risks in letting it live a little while, either.

Improve this answer
3
  • Just to be clear, are you saying that I shouldn't put a limit on the number of resend attempts ? That can lead to a spamming issue which is a bigger risk than the DoS afaict
    – Michael
    Commented Dec 19, 2019 at 13:26
  • 1
    The reasons, and therefore the configuration of that limitation, are different. If you are relying on the anti-spam control to protect the OTP, then you are splitting the reason for the control. Limit sending just for anti-spam control, but my suggestion is to not consider that as any type of protection for the OTP. It shouldn't be considered. That means your limit can be 100 and you don't have to consider the impact of that on the OTP.
    – schroeder ♦
    Commented Dec 19, 2019 at 13:53
  • Limiting resend rate to something like 1/second should be reasonable, since the expectation is that the user need to check phone/wait for sms etc and then click back on the resend link if it doesn't appear. There shouldn't really be any impact on a real user by doing this.
    – Jack
    Commented Dec 19, 2019 at 23:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .