Many providers are creating OTP authentication for their sign in. However I noticed that all the voice and SMS OTPs I've come across are a series of 6 digits... similar to the HOTP RFC Standard emitted by Google Authenticator.
I see these six digit OTPs when:
- Authenticating using a phone call (Google & some banks ...)
- SMS to my phone (Facebook & Google ...)
- Verifying an account through verified email address
- Verifying my home address (Google Business, IRS strong authentication)
... namely any OTP that doesn't use a smart OTP token or device (YubiKey, Google Authenticator,Gemalto, etc)
With regard to protecting the IdP that issues the OTP, what are the benefits and drawbacks of using a random number vs a seed like HOTP?
Here are how a few scenarios could play out if the one time password is stored in a database. One scenario is HOTP-style seed based, the other scenario is random number based:
If the (salted) password database is stolen/extracted, it's likely that the HOTP seed is stored in that same location. Datacenter security in this scenario relies exclusively on protecting the database & HOTP seed.
The attacker would have the HOTP seed until that seed is reset, which is likely never.
Conversely, if the number is generated from random() and written to the database then there is no seed to compromise. The only way it could be exploited is if the attacker had real-time read access to the database.
From that quick outline it appears that seeded OTP (like HOTP) should not be used in these scenarios (voice, and SMS).
Is this a correct conclusion?