1

I want to authenticate a user on a 3rd party website (this is more or less an OAuth flow, so this website will be able to perform actions on behalf of my user afterwards, e.g. receive some of her data). My user is already authenticated in my mobile app.

Now usually multiple websites implement OTP in a manner where I enter a code that is generated on a mobile device (SMS message, authenticator app or any native app).

I would like to reverse this flow, i.e. generate an OTP on a website and allow user to input it in a mobile app, where he is already authenticated.

On a 3rd party website there might be a new, child window opened that downloads OTP directly from my server via an API.

Question: are there any disadvantages to this flow?

PS I see the following advantage: in normal flow, a fake 3rd party website would "steal" my OTP. In my flow, even if they could see the OTP, the actual matching is performed only after code input in an authenticated environment. Before user inputs the OTP, it is not even associated with the user!

0

Your "advantage" is wrong; this doesn't make you any more secure. Instead of trying to trick the user into typing the OTP from the authenticated app into the phishing page, attackers will just try to trick the user into typing the OTP from the phishing page into the authenticated app.

| improve this answer | |
  • I understand this will not make it a disadvantage, at most both methods will be on par? – user2530062 May 4 at 21:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.