1

Scenario: a web app with two-factor authentication using username/password and hardware OTP.

Once logged into the app, one of the app modules should be used in a tablet or any mobile device without a USB port available. Should the application be able to generate a OTP and pair it with a user then allow the user to log in to the app from the mobile using that code alone?

  1. User logs in from a computer.
  2. User generates an OTP from the app.
  3. User goes to https://example.com/mobile_module/username.
  4. User enters password and OTP.
  5. User gets authenticated and the OTP is nulled.

Is there a better way to approach it?

Improve this question

1 Answer 1

Reset to default
1

I think this is a reasonable approach, as we have seen countless websites being hacked and millions of passwords being stolen. Using a two-factor authentication mitigates the risk.

Depending on the security level of your installation, a hardware based OTP is not needed. Software-based OPT, like Google Authenticator, will suffice in most cases.

You can use Google Authenticator for Android, iOS, Windows Phone or Windows.

There are libraries for use it in PHP, Perl and ASP. You can even use it with SSH.

Besides being cheap (users generally already have a smartphone), software-based tokens are harder to lose, as it requires the user to lose or factory-reset the phone. Those cases can be solved by sending a reset link to the user, asking for some other information to authenticate the user, like a secret question, phone number or any other piece of information that is hard to guess.

Improve this answer
2
  • I've considered the software based otp but this is for a private doctord office recorf keepih applicstion and for somereadon the feel safer with a udb "key"
    – Carlos Arturo Alaniz
    Sep 1, 2014 at 17:32
  • I don't think this is a likely scenario for a hardware based OTP. Hardware based is generally used on military, defense, infrastructure, and when a breach causes immediate financial losses, like banking. Software based tokens are sufficient for almost every other use. If you want to use Hardware OTP, you must consider server hardening, secure programming, DMZ, secure database servers, and lots of security infrastructure. The token is only a fraction of the security.
    – ThoriumBR
    Sep 1, 2014 at 17:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .