There has been similar questions before where people say that using some other means (sms, hardware devices, etc.) is a more secure way to provide 2 factor authentication. Provided we don't have an option to do it this way, will a simple email OTP improve the security nontheless compared to just username/password? Is it possible that it might weaken it somehow on the other hand?

The flow is like that:

  1. User enters a username/password, and hits log on
  2. User receives an email with an OTP which he puts in the field that is visible after completion of point 1
  3. If the user does point number 2 within 5 minutes after completing point number 1, he is logged on (in other words OTP expiration is 5 minutes).

OTP is a simple 6 upper case symbols string like that: ARKOGD

2 Answers 2


This is essentially the scheme that Steam uses if you log in from an "unknown" device.

It increases the security slightly, as an attacker would need to compromise both the username/password combination for the application, and the email account of the user. This effectively makes non-targeted attacks worthless.

This could be argued as a bad thing - if the system does not also incorporate the standard protections against brute force attacks, it would be relatively easy to try lists of potential usernames and common passwords, looking for the second login screen to appear, then specifically target those users. The users may well assume that since they've not attempted to log in, the email must be a mistake, and hence not realise that they may be coming under attack.

It also doesn't work well for some circumstances, such as for a mobile application. Many people nowadays receive email to their phones, so an attacker who had access to the mobile device may well be able to log in without further effort. This is no different from an SMS token though.

There is also a slight usability impact, especially for users who may not be highly skilled with web browsing. In some cases, switching between a login form and email client (even if in another tab) may cause issues, resulting in frustration with the site. This is probably why Steam only uses this method for "new" devices (or at least, ones where cookies are disabled, which in turn suggests a reasonable level of security awareness).

  • You bring up an interesting point regarding 2FA for mobile applications. The big 3: text, email, and token generator mobile apps are all ruled out...
    – TTT
    Commented Feb 4, 2016 at 16:31

Well, it is two-factor, so it does add some security. It's not great two factor, for a couple of reasons. The user is very likely to read email on the same machine they log onto your service with, but that's also a problem with SMS a lot of the time. And of course email is a very insecure channel.

But on the whole it will usually be better than nothing, from a pure security standpoint.

(It might not be worth the user experience degradation though. For example, email is often a bit slower than SMS, so the user will have to wait. Also you have spam filters to contend with. But all that depends on the specific application.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .