I am reading about hardware-based 2FA and wonder about counter-based OTPs generated from, for example, a Yubikey. I have read that in these cases, a push of a button generates a string composed of a public key, a counter, and the OTP. The service verifies the OTP using the public key and the counter, and ensures that the counter is higher than a previously used counter using that public key at that service.

But a different service would not be able to know if this OTP (for counter 50, let's say) had been used someplace else. Am I correct or am I missing something? How is this dealt with?


Am I correct or am I missing something? How is this dealt with?

No. You're right. This is up to the backend to deal with. If it doesn't do anything about that then that's just the way that is.

To counter this you could e.g.

  • imagine something like keeping a centralized round robin database of the last five minutes of used codes. (Assuming that after 5 minutes or so, they're expired anyway and you can remove them from the database.

    New table stores salted hash of accepted TOTP codes to prevent replay attack. TOTP plugin rejects codes that are stored. Stored codes are cleared on cron after 1 day,

    We will implement a watermark system which records that last interval used.

  • Only accept the TOTP via HTTPS, so it is harder to intercept in the first place.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.