I previously asked a question here What's the use of adding a challenge to a one time password algorithm?

Let's suppose that a hacker has succeeded to collect tokens. Is there a way to detect suspicious activity with them ? For example if the user creates another token and uses it and hackers use previous tokens, could server detect this as weird because user shouldn't have used new token before previous ones ?


Sure, but this makes a certain set of assumptions.

  1. The OTP is event-based, not time-based
  2. You have to be tracking previously used tokens
  3. You have to track expected future tokens
  4. The user doesn't have the ability to reset their OTP sequence with the initial seed

In theory with an event-based OTP once you use it anything generated before it is unsuable because the server should only be expecting OTP's generated after the current one. So if an attacker collected unused OTPs they wouldn't work after the user authenticates with the latest OTP.

  • how do I know if it is event based not time based for a smartcard with disconnected reader ?
    – user310291
    Jun 24 '12 at 7:21
  • if one adds these precautions is no challenge is ok ? Because it adds a lot of typing for user.
    – user310291
    Jun 24 '12 at 7:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.