24

(Note: I am not actually planning to do this. This question is strictly theoretical.)

TOTP is commonly used as the second factor in Two Factor Authentication. It is an open standard with available implementations in multiple programming languages and platforms. There is an easy to use client app for both iOS and Android in the form of the Google Authenticator app.

Is there any fundamental security issues with using TOTP as a single factor authentication method in place of passwords? Ignoring of course that single factor authentication really should be discouraged.

Improve this question
2
  • 1
    No way. What it's easier, to give your password or to lose your phone/key fob/whatever token? If you follow best practices about passwords, it is practically impossible to guess. However if you use just "something you have", if that device is lost, stolen, etc, who gets it have full access without further restrictions.
    – user15194
    Jun 10, 2013 at 14:25
  • @TheIllusiveMan "if you follow best practices". Just want to add that in 2022, as it was in 2013, this is still a big if.
    – sourcream
    Aug 2, 2022 at 12:00

4 Answers 4

Reset to default
21

I have done some thinking on this topic and I would like to present my ideas. Feel free to draw your own conclusions.

Facts

  1. The secret used for the TOTP algorithm is a 80-bit randomly generated key encoded with base32. This probably more secure than the passwords most people use.

  2. The secret key is usually presented in the form of a QR-code to be scanned by the Authenticator app. Alternatively, some services also provide the base32 encoded secret key for manual input.

  3. In an Android device, the secret is stored unencrypted in an SQLi database file. The SQLi file is located at /data/data/com.google.android.apps.authenticator2/databases/databases. However, this file isn't accessible to any application other than the Authenticator app itself. Obviously this does not apply to a rooted device. I do not have a rooted iOS device so I am unable to comment on the specifics of the iOS version of the Google Authenticator app.

My conclusions

In my opinion, there are some benefits and drawbacks to replacing passwords with a TOTP authentication solution.

Benefits

  1. Assuming that the Android device in question is not rooted, no other application besides the Authenticator app can access the secret stored in the database. This removes a very large risk of malware hijacking the secret used for authentication. Any keyloggers/screenloggers will only be able to grab the temporary password that expires in 60 seconds. This is a very small window unless you are the focus of a very targeted attack.

  2. Using TOTP removes the possibility of an attacker performing an online brute-force attack against the service. The window of opportunity is simply too short.

  3. To some people, this is a good tradeoff between security and convenience. Most people I know carry a smartphone around 24/7. Authentication is a simple matter of accessing the app and keying in 6 digits. To some people, this might be easier than having to remember relatively strong passwords or carrying around a password database.

Drawbacks

  1. A database compromise means having to reset the secret. This can be really troublesome for the users.

  2. A user losing his/her smartphone means losing access to the service.

This is quite interesting to think about. However, in the real world you should obviously use regular passwords and one-time passwords together for 2FA.

Improve this answer
2
  • 2
    As per Nemo's answer and my answer here, a 60 second window actually does not prevent brute force.
    – AndrolGenhald
    Jun 2, 2019 at 7:51
  • 1
    "A user losing his/her smartphone means losing access to the service." A forgotten password means the same.
    – sourcream
    Aug 2, 2022 at 11:50
5

Another factor to consider is that the entropy of the final TOTP result is quite low - 6 digits numeric. If you have a large list of usernames, you could just keep trying the same TOTP for all of them and you will eventually succeed at some of them, and the number will keep rising because you'll get another run every 30 seconds.

The standard rate-limit solutions apply here, but in this case - you don't have to try all the combinations all the time (which is the case with passwords) - if you have a targeted user account - you'll just keep on trying a limited number of TOTPs (as per your rate limit constraints) every 30 seconds.

Improve this answer
3

Anybody owning the seed can generate the same sequence of tokens/passwords. I think this is insecure enough to not allow this as single login token.

Improve this answer
1
  • 13
    As a single factor it is no different from a password. The seed (key) is longer than most people's passwords, so that could provide some level of assurance on the level of entropy, but as Uwe points out, just like how with a password anyone who knows the password can get in, in this case anyone who knows the seed can get in. if you have implemented it to this stage, what holds you back from doing it right as 2 factors?
    – Rod MacPherson
    Jun 10, 2013 at 12:39
0

This is basically what Twitter is doing with their 'digits' authentication system https://get.fabric.io/digits

The strength in this algorithm is its resistance to brute force attacks and the inability to reconstruct the secret from the codes themselves.

For most simple password based systems, trust is established by ensuring that the user knows the same secret that you know - ie password. With TOTP on the other hand, trust is established by ensuring the user has possession of the shared secret. So, if someone stole your phone, they'd have access to the system without knowing any other passwords (they could be slowed briefly by the unlock code but those aren't hard to bypass).

Fundamentally I think the security of the protocol is based on how much user's value possession of the secret. I think most people guard their phone's closely, but they are often lost or shared with friends and loved ones.

Improve this answer
1
  • Password are also "lost or shared with friends and loved ones".
    – sourcream
    Aug 2, 2022 at 11:52

You must log in to answer this question.