1. Login to site (using 2SV).
  2. One-Time Password (OTP) is sent to client's device.
  3. Client won't finish authentication process.
  4. On the next day (let's say after 24h) users logins to site again.
  5. OTP generated yesterday is still valid (it was re-sent to the client's device).

As far as I understand, with time-based OTP (TOTP) this shouldn't ever happen, if the implementation is correct. Questions:

  1. Is this a valid approach for HMAC based OTP schemes, or does this scenario indicate a mistake in the implementation (i.e. counter should increase after subsequent login)?
  2. If the scenario is not considered secure, what are the security implications?

1 Answer 1


RFC 4226 was defined way before google formed the idiom of "two step verification". Two step verification does not necessarily has to do anything with HOTP or TOTP. Of course you can use HOTP to create "non-guessable" codes, but it is not necessary.

Your service could simply remember which code was sent to the user.

In any case you should:

  1. create a code for each login attempt and
  2. the code (even with HOTP) should only be valid for a certain time.

The implementation in privacyidea does it this way. It can send codes via text message or email to the user. These codes are calculated based on HOTP. But the codes are only valid for a certain amount of time. And the code is only valid for this very login session.

The question is, if the code residing in the smartphone or the email account is probably though to be more vulnerable. A dedicated attacker probably would not care if the code is on the mobile phone for 30 seconds or for 30 hours. But ask yourself. I would feel uncomfortable carrying around my smartphone, knowing that there is a code in it, that still can be used to login to any of my accounts. Sometimes the smartphone is not locked, or a malware could be installed just in this time - after receiving the code and before using the code. There are additional attack vectors. So you should invalidate the code after a few minutes.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .