1

Imagine if a user inputs a valid google auth code to LOGIN. We perform the login action. Now the user navigates to the fund transfer page and code is still valid (still within the 60 seconds or so of its timespan shown in the app). Should we consider the code valid, or should we say wait for next code or something like that? Is it bad security wise? (Any links for more information would be much appreciated)

5
  • It's exactly that trade-off. The user gets a new code every 30 seconds and I think old codes should be valid for 90 seconds. If you enforce a code to be used only once you get better security at the cost that the user can only perform once action per 30 seconds. What you should consider is, that if the first code gets intercepted, possibly the first action is replaced by a malware action and you won't gain much security by invalidating the code. On the other hand, a passive attacker can only try to be faster than the user and gains a lot by having at least 60 seconds after getting the code.
    – allo
    Commented Oct 26, 2022 at 12:42
  • 2
    Frame challenge: why are you making users do 2FA twice within 60 seconds on the same device? You should in general never require that, unless they do something like logging in, saying "forget this device and log out", and then logging in again that fast. Commented Oct 26, 2022 at 13:00
  • @allo less doors for attackers maybe? Does anyone allow the same gauth code within the timespan anywhere?
    – ClassY
    Commented Oct 26, 2022 at 13:12
  • @JosephSible-ReinstateMonica it is common advice that sensitive transactions should trigger a 2nd MFA challenge.
    – schroeder
    Commented Oct 26, 2022 at 14:16
  • @JosephSible-ReinstateMonica I expect very sensitive operations to always require my 2FA... say: I'm accessing my banking app, perform 2FA to login. My phone falls from my hands and an other dude takes it for a few seconds and sends themselves money... I want each transaction involving my bank to require 2FA, even if 60 seconds before I passed the challenge.
    – GACy20
    Commented Oct 26, 2022 at 14:40

2 Answers 2

1

RFC 6238 insists that an OTP MUST NOT be re-used:

The verifier MUST NOT accept the second attempt of the OTP after the successful validation has been issued for the first OTP, which ensures one-time only use of an OTP.

There is a huge problem with duplicate accepting of OTP, and allowing multiple accepting enables attack vectors that OTP by design prevents. If you have a Person-In-The-Middle (PITM), then they could easily reuse the OTP code to gain access.

It makes sense to revisit your use case though. What is the purpose of OTP here? At a first glance you are using OTP to authenticate the user. Now they are a more privileged user. This is known as Step-Up Authentication, and is defined in RFC 9470.

Let's separate who they are from what they are doing. Just because the user went to a different page doesn't mean they aren't who they say they are. They are still exactly that same user with the same identity. Forcing them to enter another OTP code, in any format doesn't make sense, you've already proven they are the valid identity and RFC 9470, explains how to treat these new tokens.

Now that we have the identity part out of the way, you might consider the case that you want to prevent certain actions based on other conditions you consider dangerous. These actions conversely should be known as requiring Step-up Authorization. (that AuthZ here as compared to AuthN as above)

This means there is a completely separate system for validation of OTP codes (if that is your condition) before performing the action. While I wouldn't recommend using OTP for step-up authorization, and I definitely wouldn't recommend using OTP for both step-up authorization AND forcing it in during login, some implementations decide to do it anyway.

This is actually incredibly bad thing to do because you are increasing the exposure of your OTP tokens to another location. Imagine for a second instead of an OTP you are forced to reenter your password. That means there are two screens in your app that need to handle password entry. And that second screen is deeply embedded in a page that likely has much worse security protocols for dealing with password entry. The more places you add, the worse your security gets and the higher likelihood that your codes/passwords are actively being compromised.

In some cases, you might be incorrectly using Step-Up authentication when you really want Step-up authorization, and reusing the same mechanism in both places, completely defeats the value of it, especially if someone needs to do the same thing within 60 seconds. That's just a bad user experience with a net negative on security.

I specifically wrote more about this topic in Step-up authorization which might actually be what you are looking for in this circumstance.

0

You cannot control the Google Authenticator application of the end-user. Therefore, the user should be able to enter the code that the app is showing, as well as those it has shown but did not expire yet.

The security-usability trade-off has already been taken into account by the developers of Google Authenticator, thus being more strict than the end-user's app will degrade usability.

There seems to be no significant added security risk in accepting a code twice in such short timeframe. RFC 6238 insists that an OTP should not be re-used, to preserve the one-time aspect in OTP:

The verifier MUST NOT accept the second attempt of the OTP after the successful validation has been issued for the first OTP, which ensures one-time only use of an OTP.

But still, since there would be little difference security-wise between accepting the OTP twice, or just not asking for a second OTP in such short time-frame, I do not think the OTP should be explicitly rejected in this case.

10
  • 1
    What do you mean by "the app considers a code valid"? The Google Authenticator app (probably others too) only shows a single code and a countdown timer, and when the timer reaches zero the code changes.
    – Danya02
    Commented Oct 26, 2022 at 13:04
  • @Wouter Then why is it called TOTP(ONE TIME) and not just time based password
    – ClassY
    Commented Oct 26, 2022 at 13:06
  • @Danya02 I attempted to address your comment
    – Wouter
    Commented Oct 26, 2022 at 13:13
  • @ClassY because in theory the OTP should only be accepted once. But here the additive security of using 2FA in such short time-frame is minimal, therefore it does not matter if the OTP is used twice in its validity period.
    – Wouter
    Commented Oct 26, 2022 at 13:14
  • 2
    @Wouter There may be HUGE difference between first and second action. Imagine someone logging into a service, and someone then taking control over the device to initate some action that requires new 2FA code. Such attacks do happen.
    – vidarlo
    Commented Mar 26, 2023 at 11:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .