Are there any dangers of sending a one time pin number from customer to my server over HTTP?

Somebody is arguing that its okay since it will only be used once. So there's no chance of an attacker reusing it after it has been used.


Yes, it is problematic.

An attacker may intercept the connection, return a "Login failed, please try again" to the client, and proceed to use the one time pin himself. If the transaction is low value, this may not be a problem, but it's trivial to avoid: use TLS.

In general, there's no real reasons not to use TLS today. Certificates are free, setup is easy, and browsers will soon mark form submissions over HTTP as insecure:


So whilst it may be tolerable in some applications, the question is why you would want that, when it is so cheap to reduce it to nearly zero?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.