A vendor implements two-factor authentication that requires us to enter a TOTP code generated, for example by FreeOTP, after user/password.

I asked them how it is possible that using two different sessions from two different computers I am able to use the same code in both sessions to log in which defies the nature of OTP (one of the sessions should fail).

Their response was that they don't implement OTP, only 2FA.

What do I reply?


3 Answers 3


Reuse of a valid token is allowed by implementations, but it is against the RFC

"The verifier MUST NOT accept the second attempt of the OTP after the successful validation has been issued for the first OTP, which ensures one-time only use of an OTP."

In some cases, you may also need to point out that "MUST NOT" indicates an "absolute prohibition" -- see https://www.ietf.org/rfc/rfc2119.txt for those phrases.

I'm sure you know this but whoever you're trying to convince might not know it!


using two different sessions from two different computers I am able to use the same code in both sessions

TOTP is time-based one time password. Oversimplified, it's just a hash of the current timestamp and the secret. So if two (or 200) devices generate a token from the same secret at the same time, the token have to be the same.

Their response was that they don't implement OTP, only 2FA.

And that means they have no idea what they are talking about. OTP is a form of 2FA. Like iris scanners, fingerprints, voice print, secrets printed card...

They let you login with two computers at the same time because they don't employ a single-session policy server-side. As long as the credentials are valid, they allow it. Just like the vast majority of sites out there: Gmail, Facebook, Amazon, Twitter... Some banks don't allow that due to "security reasons", but allowing multiple sessions is the default behavior almost everywhere.

  • 2
    TOTP is time-based, that's literally what the first "T" stands for. Time-based One Time Password. There are other OTP schemes that are more truly one-time.
    – CBHacking
    Commented Feb 3, 2021 at 0:56
  • I've edited his answer to reflect @CBHacking your point.
    – nethero
    Commented Feb 3, 2021 at 9:59
  • @CBHacking I guess still time is always a factor. Even if you use a (offline) hardware token (displays the OTP when you push the button) and when you push the button again forces it to display another OTP, there still must be some period of validity of the same. In any case, I guess the fact that they generate a token using RFC 6238 does not mean that the backend /must/ check for unique usage...
    – Marki
    Commented Feb 3, 2021 at 11:58

OTP is either one-time, or it isn't OTP. I think this is what your vendor is telling you... they aren't OTP, just 2FA.

OTP isn't just time-based. It's also "service" based. What I mean by this is that A true OTP system will have intelligence built into it so that a given token can only be used once. In general, this would mean something on the server side that talks to the OTP backend and passes the token you provide. Once the token has been used, it is invalidated and cannot be used again... even if the second attempt is within the timeout period.

I suppose the strictness of this policy is configurable. My experience is with SecurID at many large banks, energy companies, governments and other highly-regulated environments. None of them allowed a securid token to be used more than once.

2FA/MFA is just two or more things needed to login. Usually one in your hand and one in your head. This could be a simple as a code written on a piece of paper and a passcode in your head, or could an SMS message, email, etc. etc.

  • Well, once you use for example FreeOTP to generate the code, chances are high we are talking about an actual OTP ;) But, the TOTP algorithm doesn't necessarily force anyone to make it truly one-shot in the backend. So this is OTP, but it is not OTP at the same time... Weird stuff.
    – Marki
    Commented Feb 3, 2021 at 7:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .