2

I was considering adding HOTP as an option to my website (alongside things such as SMSed one time tokens which I already have). But I was considering one issue that HOTP inherently has:

Things such as the iPhone usually get backed up along with all app data. That would mean, say I'm using Authy to generate my OTP tokens, the secret keys from within Authy would get included in such backups as well. Well, the entire purpose of OTP is so that information on the computer is not enough to break into an account and you need that second factor just in case something such as malware gets onto the computer (if I understood properly). But this backup means, if I have access to your computer, I can get your password through conventional manners such as a keylogger, but I can also look through your mobile phone backups for the HOTP secret key and without your phone, successfully log in.

So what's keeping people from doing that, and why should I also offer HOTP or is it better for me to still just stick with only SMSed tokens?

Improve this question

2 Answers 2

Reset to default
2

Some phones send SMS messages to a computer in realtime when nearby it (Samsung has a little thing for their android phones that does this, or did), and if the phone is plugged into a computer and supporting Hayes modem commands, those can read text messages in realtime too.

Really, what OTPs get you is protection against people guessing passwords, though they are sometimes helpful with stolen ones too. That said, TOTP would be better for this given that it is ephemeral and thus the chances of getting it right don't increase as the number of attempts do. The HOTP is really not much better than a password consisting of the key and counter (in my opinion), except that it effectively comes with its own challenge auth for anti-replayability.

If you need to be secure against people stealing the tokens from phone backups or whatever, you really should issue hardware tokens.

Improve this answer
1

SMS and and smartphone apps are vulnerable to different attacks. I would not call SMS a secure method to transport a one-time password. As Falcon was pointing out: If you really want to do two-factor authentication (2FA), you should use a second factor that cannot be sniffed and cannot be copied. The first is not valid for SMS and the second is not valid for smartphone apps. So, for a real 2FA you really shouldn't use a connected piece of hardware.

But nevertheless, security is shades of grey. So sending an SMS or using a smartphone app (no matter if HOTP, TOTP or mOTP) in addition to the password, is better than only having the password. You just need to be aware of "how much better" it is.

Having a smartphone app has some advantages over sending SMS:

  1. you do not have any SMS costs
  2. you will be also able to authenticate, even if you have no GSM service (like in datacenters with big walls or under the earth).

Ofcourse SMS provides an easier registration process for the end-user than installing an mobile app and sharing the HMAC-key with the server.

So providing HOTP and SMS is primarily a convenience for the end-user.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .