I am evaluating a two-factor authentication system that uses a time-based one-time password algorithm. This runs as an Android application.

As you would expect, this seems to be using a seed and the current time to generate a one-time passcode. The seed is stored in the data/data directory so is relatively well protected.

However, the time is fully under my control. I have set the time into the future, grabbed codes, and then used the on schedule.

This seems like a bit of a glaring hole in soft-tokens. Get hold of the phone for 10 minutes, set the time to the future, grab a series of tokens, and then reset the time.

If I had a hardware token, it would be virtually impossible for me to change the time into the future, grab codes, and then revert the time in the space of 10 minutes.

I feel this is a viable risk for many users who can be careless with leaving their phone unlocked.


  1. Why is this not a problem?
  2. How would you mitigate against it if it is a problem?
  • So your threat model is bad guy has access to somone's email and to their phone? – Neil McGuigan Dec 8 '15 at 21:51
  • Why do they need access to their email? – Cybergibbons Dec 8 '15 at 21:52
  • So your threat model is bad guy knows user's username and password and has access to their phone? – Neil McGuigan Dec 8 '15 at 21:59
  • Well, if your threat model doesn't include knowing the username and password, there isn't much point in implementing 2FA. – Cybergibbons Dec 8 '15 at 22:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.