Questions tagged [one-time-password]
One-time password (OTP) protocols and implementations (software and hardware)
197
questions
0
votes
1answer
72 views
Password protected wall
I'm currently building a website where you have an account and can do "dangerous" things with it. I want to password-protect these things, so the user has to type their password, if they ...
2
votes
0answers
117 views
How is a bad actor able to disable Amazon's 2-step verification without supplying a OTP?
My wife's Amazon account was hacked yesterday. She discovered the purchases, changed her password to both gmail and Amazon, and enabled Amazon's 2-step verification (2FA) through SMS on her phone and ...
0
votes
1answer
35 views
What could be the reasons for two different OTP messages for the same merchant when we do online transactions through debit card?
While I was doing a transaction (say adding money to one of the mobile wallets) through a SBI debit card, I could see two different OTP messages for different transactions. (Please refer to the image)
...
0
votes
2answers
51 views
In case of TOTP code generation, why do products prefer a generic authenticator apps, such as Google Authenticator?
All the products supporting TOTP-based 2FA use one of the common authenticator apps such as Google Authenticator, Authy, etc.
I want to understand whether there are any security reasons behind why ...
0
votes
0answers
87 views
Why my mobile sends SMS to a random number without my permission?
My mobile sends SMS to random numbers without my permission. All messages are sent automatically. Here is an example of an SMS.
SBIUPI qUrXgeX26iEY%2B2si9JHhubIjm7R2aHoo6pWcbXBpJho%3D
All the ...
0
votes
2answers
102 views
Is an OTP alone useful for a hacker?
Further, does an unused OTP expire by itself? i.e in regards to digital banking - in case a hacker accesses your SMS's through malware or other means.
1
vote
1answer
109 views
A proposal for effortless two-factor authentication
I have an idea for device-level two-factor authentication that involves no direct input from the user, and I wanted to find out if something like it has been tried before.
Let's say I have an account ...
0
votes
1answer
129 views
How to use Yubikey 5 NFC for online accounts, Linux login, and KeePassXC?
I just got my Yubikey 5 NFC, and would like to use it for
Linux desktop login
Linux KeePassXC (which only supports hmac-sha1 challenge-response)
online accounts
When reading about U2F it seams to be ...
0
votes
0answers
58 views
Combine HOTP and TOTP
I want to build a custom OTP implementation that utilizes the HOTP/TOTP algorithm.
I need to create several codes (one time passwords), which are all valid for the same time window in the future (e.g....
1
vote
1answer
116 views
Password reset link vs Temporary password
Which is harder to exploit:
Password reset link with tokens/timestamps/code/ticket etc
Or, temporary password sent on user mail using which login can be done and password can be changed.
Any ...
16
votes
3answers
4k views
Am I generating email link tokens correctly?
I am developing a reliable system for token generation and validation used mainly for links in confirmation emails (reset password request, change email flow, activate an account, etc...).
There are ...
2
votes
2answers
259 views
How do backup codes work in TOTP, like Google Authenticator?
My understanding is that in TOTPs are like HMAC where code is derived from time.
However, I am struggling to understand the concept of Backup Codes in Google Authenticator, and how are they ...
0
votes
2answers
101 views
2FA: Do app passwords render the second factor invalid?
I am currently in the process of employing a 2FA authentication on as many services as I can. If it is relevant for the question: I use a time-based OTP authenticator app.
When setting up, I noticed ...
1
vote
0answers
46 views
Why have a password at all? [duplicate]
Consider the following common security scenario:
I need to log in with an email and password.
I can't remember my password so I click "forgot password"
Website emails me a password reset link.
I can ...
2
votes
2answers
103 views
How does password-append OTP validation work?
Recently when I was changing some Amazon account settings, I've noticed that they provide an option to validate the OTP by appending it to the password. How would this work, if the password is one-way ...
1
vote
1answer
51 views
Is it unsecured to use TOTP codes on the device that generates them?
Let's say I have a TOTP generator app (like Google Authenticator) installed on my smartphone. I use it for 2FA for service X. How bad is it if I log in to X's website/dedicated app on the same ...
1
vote
1answer
374 views
Is there a reason to change OTP code on every resend attempt?
This question is about OTP codes that are used in flows like
Email verification
SMS 2fa
Usually, when you send an OTP, you want to give the user an option to resend the OTP.
Assuming the following ...
0
votes
2answers
207 views
How to encrypt data with a one time password?
We can generate OTP using HOTP - RFC 4226 and TOTP - RFC 6238.
But the generated OTP normally has a checking function authenticator.check(token, secret);. But this only checks if the OTP is valid.
...
0
votes
2answers
226 views
one-time link on 1ty.me
1ty.me is a website that allows you to send secret messages (password, nuclear code, etc.) to someone with a one-time link. So when someone receives the link and clicks on it, the secret message is ...
3
votes
0answers
94 views
One time password: combine time window and counter
I want to generate an OTP, that is valid once in a certain time window in the future. That time window is in the range of minutes to hours. After being used in that window, the OTP may not be used ...
0
votes
1answer
529 views
Is it possible to bypass 2FA and access bank account in this system?
Nowadays, any credit/debit card transaction made online (at least for mine) requires one to enter the card details (Account No., Expiry Date, CVV etc). In the end, a OTP (One Time Pass) is sent to the ...
2
votes
1answer
208 views
Can 2FA / MFA be secure & functional in a purely offline state (PWA)?
I'm building a Progressive Web App intended to be used primarily in an offline state. The user can "login" while disconnected, which verifies the password against a locally-stored hash and some other ...
3
votes
1answer
77 views
Protect page sms verification from spamming
I'm developing a merchant page where users can pay their bills.
On this page, users must fill in their bank details (Card number, card holder name, expiration date, CVC).
As a verification, we have a ...
0
votes
0answers
115 views
Is there any Password Manager that supports Hardware-Based OTP encryption/decryption?
I see that some projects like KeepassXC use CR based OTP to provide some additional security. While this is discussed quite controversial my opinion is that - for quite some cases (e.g. most non-...
49
votes
5answers
8k views
Why do many websites hide input when entering an OTP?
I've noticed that on many sites, when they ask for a one-time password (OTP) (usually sent by SMS), the input is hidden in the same way as a password field is.
My understanding is that once an OTP is ...
0
votes
0answers
34 views
One-Time Password (Email or SMS) as the Only Authentication Information [duplicate]
I was wondering about the implications (mainly in terms of security) of using a random, one-time use, password sent by email or sms to authenticate users to a web application.
The application would ...
1
vote
2answers
376 views
Is it safe to save a screenshot of my QR code?
For MFA I now use Authy (owned by Twilio) instead of Google Authenticator. I find Authy more convenient because it syncs your accounts between several devices and several authy installations which ...
1
vote
2answers
261 views
When resetting a password using OTPs, how can I prevent users from bypassing the OTP input page?
I am implementing the password reset functionality using OTPs (one-time passwords). When the user clicks on the 'forgot password' link, he / she is sent an OTP and is redirected to the OTP input page. ...
30
votes
4answers
14k views
Bypass with wrong cvv of debit card and getting OTP
This is happening in Visa/MasterCard/American Express, etc. I tried checking in many payment apps and payment gateways that if I enter the correct debit card number, name, valid date, and wrong CVV ...
1
vote
1answer
134 views
What point in Authenticator App 2FA when SMS fallback is enabled
I would like to move away from SMS 2FA (because of Should 2FA over SMS be considered insecure in the wake of recent SS7 attacks? for example).
But some services that provide Authenticator apps ...
0
votes
0answers
647 views
Persistent OTP on Web Browser using cookie
Currently I'm planning to use OTP for my web app, I'm a bit confused about how to keep the users logged on the app. My plan is to use cookies, but I'm not sure whether this is correct or not.
This is ...
0
votes
1answer
115 views
Am I making my One-Time Passcode less secure?
I am using some "magic link" one-time passcodes for automatically logging users in for a specific purpose on our website.
My plan is to generate a hash based on the datetime, users specific "ID" and ...
0
votes
1answer
78 views
What will be the problems if 2 users receive the same OTP in an arbitrary time gap?
First of all, I sincerely apologise if this question has already been asked before. I searched in Google and on this website but was unable to find any article.
I have seen that most OTPs are 6 ...
0
votes
0answers
107 views
Storing TOTP codes on a Feiteian ePass FIDO key
I'm looking for some Android apps that can store / read TOTP codes off of a Feitian ePass FIDO key using NFC. There appears to be a fairly simple way with a yubico key / and key but I don't know how ...
4
votes
2answers
3k views
Which is more secure Yubikey + Keepass using Challenge/Response or Yubikey + Keepass using OTP?
I use a Windows 10 PC and an Android phone with Keepass.
I would like to add a second factor on top of my master password that works with both Windows 10 and my Android phone.
Between the two ...
3
votes
2answers
507 views
Is stand-alone one-time password less secure than OTP + traditional password auth?
I have a client that would like to use one-time passwords (via SMS or Email) for their app, and their requirements spec does not include traditional password-based authentication. I haven't seen this ...
4
votes
2answers
313 views
Telegram (or other messenger) message as second factor in 2FA
Is it safe to send code via messenger bot and use it as second factor in auth? The scheme looks like the same as SMS one. A user opens application or look at a push notification and use the code. Why ...
2
votes
1answer
234 views
Security implications of auto-submitting OTP?
So the question was originally asked as a part of the UX question here.
My question is that, Are there any security risks involved when I auto-submit the OTP? Currently, I'm limiting the number of ...
3
votes
3answers
2k views
Bank sends one-time password by e-mail (while sending on SMS) for transaction verification; is this insecure?
Most of the banks uses OTP (One Time Password) to enrich the authentication through dual factor.
But I observed Banks are sending the OTP to mobile as well as email.
I suppose sharing passwords on ...
1
vote
1answer
158 views
Is it safe to receive (One Time Password) OTP to the Mobile where the online banking application is installed?
Assume a customer of a bank is using online banking facility and he is using an online banking application on mobile (android).
There could be a possibility that particular mobile could be ...
4
votes
2answers
799 views
Do all Authenticator Apps use the same algorithm?
I've tried some Authenticator Apps (Google,Microsoft,Authy,Lastpass,...) and all of those apps generate same one time passwords at the same time ?
So, these apps are use the same algorithm which is a ...
0
votes
1answer
33 views
Will evolving bio metric capabilities on mobiles replaces online transaction verification through SMS (OTP)?
We are working on an online eCommerce site and we need to have online transactions. The common mechanism of verifying the online transaction seems the OTP (one Time Passwords) over SMS.
But this ...
1
vote
1answer
415 views
Best practices to protect public/private SSH key pair in web interface?
I've got a dilemma here: I'm working on a system that will connect to remote linux servers for monitoring and automating some processes. Since user+pass is insecure for obvious reasons and public/...
0
votes
1answer
673 views
What should be the life time for SMS OTP?
I've tried to find such a standard that mention the lifetime of SME OTP, however, NIST is no longer recommended using SMS OTP due to the risk involved.
Regardless of the security concerns, I still ...
8
votes
2answers
386 views
Why use one-time codes for two-factor authentication backups?
I am building an web application that uses two-factor authentication.
While implementing the recovery feature, I see that most companies (eg Apple, Facebook, Github) provide a set of ~15 backup codes,...
1
vote
1answer
229 views
SMS OTP as 2FA - should there be sms session id in sms for user's verification?
Several times I saw SMS 2FA implementation when a web site shows "sms session id" (say, 8 digits token) right after sending sms to user together with OTP prompt. Sms comes with OTP (say, 4 digits) and ...
1
vote
1answer
128 views
Should I reply to an email saying that I requested online access to a website?
I received an email saying I requested access to a website. The email also includes a one-time passcode. I did not do anything that would require a one-time passcode. At the bottom of the email is a ...
0
votes
2answers
612 views
OTP generation is specific to SIM or Phone number
Are the messages including OTP sent to a mobile phone addressed to the SIM card or the phone number?
If I decide to have a new phone number and the old phone number is allotted to a new customer, the ...
2
votes
4answers
536 views
Does a two-factor authentication dongle (OTP) which is always inserted in MacBook add a security benefit?
I think to get a Yubikey and read that Keepass with OTP makes no sense No. Security remains the same + extra cognitive overhead.
I try to store all data local and use seldom cloud based services.
If ...
1
vote
1answer
2k views
Why is the need to expire OTP?
OTP can be implemented either using Google Authenticator or by sending SMS to the user. The GA code is created using a timestamp and the code expires if it's used after some time.
However, in case of ...
