At work we use an authentication system called Swivel Secure without implementation specifically when connecting to our customers devices such as: routers, switches, firewalls, etc we must provide a OTC (for 2FA of course)
For example if I connect to a switch I must provide: username, password & a OTC in order to get a OTC we must visit a link which generates an image (See below example)
A link typically looks the following way - https://PinSecurity.StackExchange.com:8443//proxy/SCImage?username=JoshJones
If you're unfamiliar with a turing image, essentially each user has a pin (which can be changed) the top numbers correspond to the numbers that can be used in a users pin & the bottom numbers are the required numbers for successful authentication.
For example: if my pin is 1234 using the image above my OTC for successful authentication would be 3087.
In Swivel there is an option which allows you to configure getting that SCImage as just a string by replacing SCIMage with SCText, I asked a developer at Swivel about this and he said: "it is disabled by default as it's inherently insecure" I found this statement to be very vague and unfortunately he didn't ever respond to my request for expansion.
How exactly is it more unsecure to generate the security string as text? I realise that it's more readable in-terms of getting it into the computer E.G you could just scrape the HTML to get the security string whereas with the image you would have to use some kind of OCR software / library to obtain the characters in the image which can be hard especially if the image is very scrambled.
So how is it less secure to generate this security string as text? It's not even like you could iterate over all combinations because there is a locking mechanism upon too many retries so you cannot get someones pin without essentially guessing it, etc
If someone could clear this up for me that'd be great. I expect I am missing something and just not thinking properly.
EDIT Following a discussion I had with DMB on the basis that one of his comments was a little unclear. We've come to the conclusion that the only REAL difference here is the time that would be spent by an attacker.
His point was that it takes them a lot less time to get the paragraph tag from the HTML than it does to use OCR software to get the required digits from the image, which I agree with (Hence why I mentioned this in my post)
IF somebody else has something else to add then please do so, otherwise I am going to write an answer and mark it as answered. I would be interested to know what OTHER risks there would be when getting the security string as TEXT rather than as an IMAGE, thanks.