Questions tagged [hotp]

HMAC-based One-time Password (HOTP) is an algorithm for generating one-time password values defined in RFC 4226.

Filter by
Sorted by
Tagged with
1 vote
1 answer
125 views

Does the lack of a secure channel really allow a replay attack to HOTP?

RFC 4226 on HOTP (7.1 Authentication Protocol Requirements) says RP3 - P [the protocol] SHOULD be implemented over a secure channel in order to protect users' privacy and avoid replay attacks. But ...
user avatar
  • 137
5 votes
1 answer
676 views

Does TOTP make sense for verification codes?

I know that the concept of TOTP is for when the device on which the code is to be verified is separate from the device that is going to generate the code. However, I was wondering if it is a bad idea ...
user avatar
2 votes
3 answers
451 views

Why would a U2F key be more secured than an OTP device?

I have a Yubikey 5, I can store a PGP key inside, it has OTP abilities, FIDO, NFC, etc... Which is great for a device like this. First of all, I understand how a smart card is more secured than an app/...
user avatar
  • 195
1 vote
3 answers
254 views

prevent/prohibit duplication of MFA software-token / ensure user identity

As I was unable to find any thread about this particular question, I'm trying to ask the community for help. We're currently using RSA RADIUS based 2FA to authenticate external VPN users from ...
user avatar
0 votes
0 answers
167 views

Combine HOTP and TOTP

I want to build a custom OTP implementation that utilizes the HOTP/TOTP algorithm. I need to create several codes (one time passwords), which are all valid for the same time window in the future (e.g....
user avatar
  • 151
3 votes
0 answers
280 views

One time password: combine time window and counter

I want to generate an OTP, that is valid once in a certain time window in the future. That time window is in the range of minutes to hours. After being used in that window, the OTP may not be used ...
user avatar
  • 151
0 votes
1 answer
191 views

How does DUO push button method and other methods actually work?

Google authenticator uses HOTP and TOTP algorithm for TFA. What is the basic working principle of DUO push? What brings security to DUO push?
user avatar
  • 3
0 votes
1 answer
444 views

Is using HOTP only authorization considered weak?

I have seen many experts advising usage of some kind of OTP as second step of 2FA schemes. I fully understand 2FA is more secure than Single Authorization, but it is also more inconvenient for a ...
user avatar
  • 217
1 vote
0 answers
352 views

How exactly do Fido Keys work? [closed]

Recently I acquired a security Fido key that allows me to use the U2F protocol on some of my accounts. Now I know that these keys use public/private keys for the specified account but I'm stuck on the ...
user avatar
1 vote
3 answers
1k views

Prevention of devices using same OTP secret

I have a requirement of OTP applications on mobile devices not sharing the same secret (even if the mobile devices are owned by the same user). A single secret must be present in a single device. ...
user avatar
  • 155
6 votes
2 answers
2k views

How many known time/result combinations does it take to guess a HOTP/TOTP secret?

I thought about "recovering", "determining", "guessing", "calculating" or "reproducing" the HOTP/TOTP secrets when only the outcome (6-digit code + time) is known. In case we can view the live ...
user avatar
  • 6,190
4 votes
3 answers
462 views

What security considerations should I make when choosing a TOTP app?

One company now requires that I either use Authy or Google Authenticator. Supposedly these are safer than getting a text message, but I'm still seeing people complain about how dangerous these are. ...
user avatar
4 votes
1 answer
802 views

TOTP / HOTP - Offline 1 hour password generator

I need to generate and valid a password / token for an hour. Client -> generate password (valid for one hour) Server -> valid it within an hour. //System needs to work offline (TOTP) TOTP is ...
user avatar
  • 143
1 vote
2 answers
967 views

How should the counter value for HOTPs be stored?

RFC4226 describes the HOTP algorithm to "based on an increasing counter value and a static symmetric key known only to the token and the validation service", specifically: HOTP(K,C) = Truncate(HMAC-...
user avatar
2 votes
3 answers
585 views

Is using the 2FA secret on the same machine as using the credentials, removing one factor of 2FA?

In other words: Is saving or using the two-factor authentication (2FA) secret on the same machine to generate one-time passwords (OTP), breaking the two-factor authentication (2FA) concept since it's ...
user avatar
  • 6,190