So the question was originally asked as a part of the UX question here.

My question is that, Are there any security risks involved when I auto-submit the OTP? Currently, I'm limiting the number of verification attempts from the backend side.

What are the points that one should keep in mind while auto-submitting the OTP? I'm designing the app for the mobile platform.


I can't see any security implication with auto submitting a field rather than requiring them to click a button to submit the OTP. At worst you may have a few more accidental incorrect password submissions when people make a typo and it submits before they can fix it.

I guess it could be an accessability issue if you set the number of attempts very low and locked out accounts as a result.

There's a the small potential that when you lower the barrier of 2FA so low people may not put in the mental effort to notice when something is wrong https://www.biocatch.com/blog/ios-12-security-otp-autofill (although that specific link referrs to auto filling from a SMS message)

  • Yes, Good point. Auto submission of an accidental incorrect password may lead to a bad user experience, IMO. Also, Number of attempts that I'm thinking of is 10. What do you think? Also, Thanks for the link. Oct 9 '18 at 7:02
  • 1
    10 attempts in how long (minute, hour, day, week, until human intervention)? And is is this 10 attempts per IP address, or per account? Do you have any provision for rate limiting the number of SMS messages that get sent out? It usually costs money per SMS, and someone could cost you a pretty penny by requesting messages for EVERY user on your service at once. Or that could lead to you account with the SMS gateway being suspended, thus preventing people from logging in. Do you have any follow up if a 2FA login is failed, like an email to the address on record saying a login attempt occur?
    – Daisetsu
    Oct 9 '18 at 7:10
  • Sorry for not being clear. I meant to limit the attempts per time basis so that I can prevent the brute-forcing of OTPs. But you suggested multiple other options using which I can limit the rate and protect the server in a much better way. Oct 9 '18 at 10:48
  • For the other question, The OTP will always be used for logging in to the account. The app is for the higher age group people who can have problems remembering the password. Oct 9 '18 at 10:52
  • wouldn't you have fewer mistakes if a computer filled in the form instead of a human? (one doesn't make mistakes)
    – dandavis
    Oct 9 '18 at 16:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.