I want to authenticate a user on a 3rd party website (this is more or less an OAuth flow, so this website will be able to perform actions on behalf of my user afterwards, e.g. receive some of her data). My user is already authenticated in my mobile app.

Now usually multiple websites implement OTP in a manner where I enter a code that is generated on a mobile device (SMS message, authenticator app or any native app).

I would like to reverse this flow, i.e. generate an OTP on a website and allow user to input it in a mobile app, where he is already authenticated.

On a 3rd party website there might be a new, child window opened that downloads OTP directly from my server via an API.

Question: are there any disadvantages to this flow?

PS I see the following advantage: in normal flow, a fake 3rd party website would "steal" my OTP. In my flow, even if they could see the OTP, the actual matching is performed only after code input in an authenticated environment. Before user inputs the OTP, it is not even associated with the user!

  • 1
    This is already implemented in couple of websites, Paysera is an example, where the OTP is shown in both sides and the user has just to to confirm on the app by sliding a button.
    – elsadek
    Oct 2, 2020 at 6:29

2 Answers 2


The methods are technically as secure as each other.

However there are a few practical caveats:

  • Both devices must now have internet, rather than just the one signing in
  • Users may have been trained not to share codes, but may just go ahead with typing one in
  • Will require a custom app or some way to receive an SMS message from the user

Your "advantage" is wrong; this doesn't make you any more secure. Instead of trying to trick the user into typing the OTP from the authenticated app into the phishing page, attackers will just try to trick the user into typing the OTP from the phishing page into the authenticated app.

  • I understand this will not make it a disadvantage, at most both methods will be on par? May 4, 2020 at 21:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .