Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [hotp]

HMAC-based One-time Password (HOTP) is an algorithm for generating one-time password values defined in RFC 4226.

0
votes
0answers
31 views

Cracking signing and HOTP blackboxes

If there are these blackboxes, both are using algorithms which are considered secure yet: Blackbox will sign any message, no limit for messages to be signed. Blackbox will generate 8‐digit HOTP code ...
0
votes
1answer
41 views

How does DUO push button method and other methods actually work?

Google authenticator uses HOTP and TOTP algorithm for TFA. What is the basic working principle of DUO push? What brings security to DUO push?
0
votes
1answer
77 views

Is using HOTP only authorization considered weak?

Migrated from ServerFault, as advised there. I have seen many experts advising usage of some kind of OTP as second step of 2FA schemes. I fully understand 2FA is more secure than Single ...
1
vote
0answers
191 views

How exactly do Fido Keys work? [closed]

Recently I acquired a security Fido key that allows me to use the U2F protocol on some of my accounts. Now I know that these keys use public/private keys for the specified account but I'm stuck on the ...
1
vote
3answers
462 views

Prevention of devices using same OTP secret

I have a requirement of OTP applications on mobile devices not sharing the same secret (even if the mobile devices are owned by the same user). A single secret must be present in a single device. ...
5
votes
1answer
563 views

How many known time/result combinations does it take to guess a HOTP/TOTP secret?

I thought about "recovering", "determining", "guessing", "calculating" or "reproducing" the HOTP/TOTP secrets when only the outcome (6-digit code + time) is known. In case we can view the live ...
3
votes
3answers
323 views

What security considerations should I make when choosing a TOTP app?

One company now requires that I either use Authy or Google Authenticator. Supposedly these are safer than getting a text message, but I'm still seeing people complain about how dangerous these are. ...
3
votes
1answer
418 views

TOTP / HOTP - Offline 1 hour password generator

I need to generate and valid a password / token for an hour. Client -> generate password (valid for one hour) Server -> valid it within an hour. //System needs to work offline (TOTP) TOTP is ...
1
vote
2answers
425 views

How should the counter value for HOTPs be stored?

RFC4226 describes the HOTP algorithm to "based on an increasing counter value and a static symmetric key known only to the token and the validation service", specifically: HOTP(K,C) = Truncate(HMAC-...
2
votes
3answers
408 views

Is using the 2FA secret on the same machine as using the credentials, removing one factor of 2FA?

In other words: Is saving or using the two-factor authentication (2FA) secret on the same machine to generate one-time passwords (OTP), breaking the two-factor authentication (2FA) concept since it's ...