Are there any dangers of sending a one time pin number from customer to my server over HTTP?
Somebody is arguing that its okay since it will only be used once. So there's no chance of an attacker reusing it after it has been used.
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Yes, it is problematic.
An attacker may intercept the connection, return a "Login failed, please try again" to the client, and proceed to use the one time pin himself. If the transaction is low value, this may not be a problem, but it's trivial to avoid: use TLS.
In general, there's no real reasons not to use TLS today. Certificates are free, setup is easy, and browsers will soon mark form submissions over HTTP as insecure:
So whilst it may be tolerable in some applications, the question is why you would want that, when it is so cheap to reduce it to nearly zero?