I was working on implementing an OTP strategy in our login process of a web application when I was asking myself: Should I ask for the OTP token before or after asking for the username/password?

What I generally see with services I use is, I have to provide the OTP token after they've verified my username/password.

I was wondering if this was just due to user experience decisions or if there was a security aspect to it.


From a security perspective, it makes sense to ask at the same time -- that way, an attacker doesn't know what they got wrong. With some services (e.g. Google), the OTP has another option to send a text message, so from a UX perspective, putting it after the password cuts back on spurious texts.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.