Scenario: a web app with two-factor authentication using username/password and hardware OTP.
Once logged into the app, one of the app modules should be used in a tablet or any mobile device without a USB port available. Should the application be able to generate a OTP and pair it with a user then allow the user to log in to the app from the mobile using that code alone?
- User logs in from a computer.
- User generates an OTP from the app.
- User goes to https://example.com/mobile_module/username.
- User enters password and OTP.
- User gets authenticated and the OTP is nulled.
Is there a better way to approach it?