There has been similar questions before where people say that using some other means (sms, hardware devices, etc.) is a more secure way to provide 2 factor authentication. Provided we don't have an option to do it this way, will a simple email OTP improve the security nontheless compared to just username/password? Is it possible that it might weaken it somehow on the other hand?
The flow is like that:
- User enters a username/password, and hits log on
- User receives an email with an OTP which he puts in the field that is visible after completion of point 1
- If the user does point number 2 within 5 minutes after completing point number 1, he is logged on (in other words OTP expiration is 5 minutes).
OTP is a simple 6 upper case symbols string like that: ARKOGD