0

When logging in to azure the login process emails me a short one time code to use and doesn't require a password. I am assuming it is a well trusted process in order to be used on such critical infrastructure, but I am not familiar with that pattern. What would you call it? Are there any special security considerations there?

It seems like it isn't quite a magic link/passwordless login as it uses a short code. It seems to be using more of a one time password type of generation but emailing the code rather than depending on an external app, and completely doing away with the password at all? Does that sound right? I'd like to make sure I understand as we would love to implement a similar pattern.

3
  • 1
    It is called what you tagged it: One Time Password. Authenticator apps use TOTP (timed OTP)
    – schroeder
    Feb 22 at 20:28
  • ah thanks for the distinction. I typically see OTP used within the context of mult-factor authentication, so I guess my security concerns would be around using it a single factor passwordless. I assume the One Time Password azure sends is also timed but with a longer duration... Feb 22 at 20:39
  • 1
    Not "timed" but a "time limit". TOTP means the code regens in a time period. What they are doing is generating a code that expires. No regen.
    – schroeder
    Feb 22 at 20:44

0

Browse other questions tagged .