Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
OTP can be implemented either using Google Authenticator or by sending SMS to the user. The GA code is created using a timestamp and the code expires if it's used after some time.
However, in case of SMS, the OTP value is saved in the database on server side. The client can take any amount of time and then submit OTP value. Then why is the expiry required in this case? I am not able to think of any security compromise. Please point out the concerns due to OTP without expiry.
For one, an attacker with temporary access to the phone could get several OTPs and use them much later, which would defeat the point of using OTPs in the first place. Another issue could be the user requesting an OTP and then not using, later an attacker could access his messages (for example from backup) and get this active OTP.
So generally, you want to make sure the user has possession of the second factor, the mobile SIM card in this case at the time, when the login is occurring.
Another thing is, that having many active OTPs increases chances of someone guessing one of them by brute force.
There is also a practical consideration, that storing a lot of unnecessary OTPs in the database wastes space.
