Questions tagged [one-time-password]
One-time password (OTP) protocols and implementations (software and hardware)
221
questions
0
votes
1answer
90 views
Are there still ways that OTP is safer than FIDO?
From my reading I understand that USB keys (for example Yubikeys) are more secure than OTP authentication apps (such as Google Authenticator). The primary reason is that FIDO is done without human ...
0
votes
1answer
111 views
Security of email OTP authentication
I'm building my own authentication and deciding on the signup/login flow. I'm would like some security feedback on this type of flow:
User submits email address.
6 character alphanumeric one-time-...
0
votes
1answer
56 views
Is this a secure way of authenticating, advice on what to change?
I have a few terminals that I currently use a static IP to authenticate. The problem is in my country the internet is not stable, so often I have to switch to mobile data, then the terminals can't ...
5
votes
1answer
611 views
Does TOTP make sense for verification codes?
I know that the concept of TOTP is for when the device on which the code is to be verified is separate from the device that is going to generate the code.
However, I was wondering if it is a bad idea ...
5
votes
4answers
260 views
Is a "magic link" a kind of authentication?
From what am I reading, magic links require users to provide their email and the user will be sent an email with the link to sign-in, and the users can use this link to log into the system.
Can this ...
4
votes
2answers
525 views
Sending OTP before authentication / password verification
One of my old, rarely used computers had still an old password for my pyszne.pl / takeaway.com account stored in my browser's password manager. I tried to log into my account from that computer and ...
1
vote
2answers
93 views
Does it make sense to split two factor authentication between identity providers
A common multi factor authentication solution will ask a user for a username+password and a one-time password.
In all documents I can find both factors are asked by the same identity provider. This ...
1
vote
2answers
138 views
Are offline OTP systems really secure? [duplicate]
I know that OTP (One-time password) system is the most secure method for now if online.
Online OTP systems, like sending code to a phone is secure because the attacker cannot know the code if he doesn'...
1
vote
2answers
165 views
How to verify OTP codes offline?
I have a use case to generate one time codes, and need to, in some cases, verify them offline. A use case:
On arriving at customers door, the delivery agent needs to verify that they dropped off a ...
2
votes
1answer
89 views
Multiple login attempts made using mobile OTP in multiple customer sites at the same time
We have multiple customer sites which provides login via mobile number OTP option (new & registered users). Recently, we come across an incident where a user received 100+ OTPs with in few minutes ...
1
vote
1answer
56 views
How secure is to authorize a website to "trust your device"?
A bank has a form of 2FA where, after you put in your username and password, they send a code via SMS to your mobile phone and you have to put that too.
On the screen asking for the SMS code, there ...
2
votes
0answers
102 views
What is the impact if there is Race Condition while submitting OTP?
I recently came across a web application where it was asking for an OTP after a successful login.
Let the endpoint be https://www.example.com/otpcode
The initial test for a brute-force of the OTP ...
1
vote
1answer
65 views
What are the security flaws in web based TOTP app?
If there is a widely accessible TOTP website (prototype: https://depperm.github.io/) that allows users to set a date and secret they can remember or a package that allows companies/developers to ...
1
vote
1answer
99 views
6 digit code to access the account?
All my security senses are tiggling when I wrote the title, but here's the scenario:
When a user wants to connect to their account, but can't remember their password, they can use the "Lost ...
2
votes
1answer
92 views
Why don't OTPs have letters?
Is there a reason why OTPs (one-time passwords) are only made up of numbers? I've seen OTPs of varying lengths but all of them are only made up of numbers. Why are they not alphanumeric?
5
votes
1answer
324 views
Securely detecting and correcting time drift for TOTP
RFC 6238 recommends the server to implement some form of resynchronization algorithm to account for time drift of the device used to generate the OTP. However, the RFC provides very little information ...
19
votes
7answers
6k views
Don't one-time recovery codes for 2FA introduce a backdoor?
Although using multi-factor authentication is clearly a good move, I'm struggling with the 'one-time recovery codes' concept. It seems to me that if you choose to use them, what you're doing is ...
1
vote
0answers
44 views
Can OTP (One-Time password) be used to protect data after intrusion has been detected? [closed]
I am working on Social Engineering attacks happening via SMSs. Let's assume a person receives an SMS asking him to click on a malicious link. If a virus is installed on the person's device, how can ...
3
votes
1answer
308 views
How should I share a TOTP shared key with my users?
I want to add one-time passwords as gates for certain important actions in the application I am working on. It is not two-factor authentication, although it may be extended to that use case later.
...
3
votes
2answers
542 views
Magic links: JWT vs random string
Tutorials I've come across about implementing magic link authentication (in Node) recommend a mechanism like this:
the user hits your endpoint with their email address
you generate a signed JWT from ...
0
votes
2answers
113 views
Protecting OTP based authentication
Let's say I have a website which uses 4 digit OTP based authentication for login i.e. users will enter their mobile number, receive OTP on the entered mobile number, enter the received OTP to login ...
1
vote
0answers
161 views
In forgotten password is asking user their TOTP among other details secure?
I have started to work on the Forgotten password feature on my website. Based on OWASP Forgot Password cheatsheet, the user should provide enough information to confirm that it is really them.
The ...
2
votes
1answer
129 views
Is phone number verifications with SMS magic HTTP links less secure than OTP?
I want to verify phone number ownership with specially crafted and encrypted payload within an HTTP hyperlink callback through SMS as opposed to sending an SMS OTP code and writing it back in server ...
30
votes
6answers
6k views
Is revealing the phone number during OTP verification process considered a vulnerability?
One of the common way of implementing 2FA is using phone number Text message or Call with OTP. As I can see, usually web services show something like:
OTP was sent to the number +*********34
Is it ...
0
votes
2answers
163 views
Best practice for authenticating resend email requests
I have a Node.js/Express 4/JWT user authentication service using Passport.js, with Sequelize and MySQL for database.
In my service, upon signing up/resetting a password, the user will be redirected to ...
1
vote
1answer
83 views
Password protected wall
I'm currently building a website where you have an account and can do "dangerous" things with it. I want to password-protect these things, so the user has to type their password, if they ...
2
votes
0answers
947 views
How is a bad actor able to disable Amazon's 2-step verification without supplying a OTP?
My wife's Amazon account was hacked yesterday. She discovered the purchases, changed her password to both gmail and Amazon, and enabled Amazon's 2-step verification (2FA) through SMS on her phone and ...
0
votes
1answer
316 views
What could be the reasons for two different OTP messages for the same merchant when we do online transactions through debit card?
While I was doing a transaction (say adding money to one of the mobile wallets) through a SBI debit card, I could see two different OTP messages for different transactions. (Please refer to the image)
...
1
vote
2answers
137 views
In case of TOTP code generation, why do products prefer a generic authenticator apps, such as Google Authenticator?
All the products supporting TOTP-based 2FA use one of the common authenticator apps such as Google Authenticator, Authy, etc.
I want to understand whether there are any security reasons behind why ...
1
vote
2answers
2k views
Why my mobile sends SMS to a random number without my permission?
My mobile sends SMS to random numbers without my permission. All messages are sent automatically. Here is an example of an SMS.
SBIUPI qUrXgeX26iEY%2B2si9JHhubIjm7R2aHoo6pWcbXBpJho%3D
All the ...
0
votes
3answers
308 views
Is an OTP alone useful for a hacker?
Further, does an unused OTP expire by itself? i.e in regards to digital banking - in case a hacker accesses your SMS's through malware or other means.
1
vote
1answer
125 views
A proposal for effortless two-factor authentication
I have an idea for device-level two-factor authentication that involves no direct input from the user, and I wanted to find out if something like it has been tried before.
Let's say I have an account ...
0
votes
1answer
503 views
How to use Yubikey 5 NFC for online accounts, Linux login, and KeePassXC?
I just got my Yubikey 5 NFC, and would like to use it for
Linux desktop login
Linux KeePassXC (which only supports hmac-sha1 challenge-response)
online accounts
When reading about U2F it seams to be ...
0
votes
0answers
97 views
Combine HOTP and TOTP
I want to build a custom OTP implementation that utilizes the HOTP/TOTP algorithm.
I need to create several codes (one time passwords), which are all valid for the same time window in the future (e.g....
1
vote
2answers
426 views
Password reset link vs Temporary password
Which is harder to exploit:
Password reset link with tokens/timestamps/code/ticket etc
Or, temporary password sent on user mail using which login can be done and password can be changed.
Any ...
16
votes
3answers
4k views
Am I generating email link tokens correctly?
I am developing a reliable system for token generation and validation used mainly for links in confirmation emails (reset password request, change email flow, activate an account, etc...).
There are ...
3
votes
2answers
1k views
How do backup codes work in TOTP, like Google Authenticator?
My understanding is that in TOTPs are like HMAC where code is derived from time.
However, I am struggling to understand the concept of Backup Codes in Google Authenticator, and how are they ...
1
vote
2answers
160 views
2FA: Do app passwords render the second factor invalid?
I am currently in the process of employing a 2FA authentication on as many services as I can. If it is relevant for the question: I use a time-based OTP authenticator app.
When setting up, I noticed ...
1
vote
0answers
47 views
Why have a password at all? [duplicate]
Consider the following common security scenario:
I need to log in with an email and password.
I can't remember my password so I click "forgot password"
Website emails me a password reset link.
I can ...
2
votes
2answers
161 views
How does password-append OTP validation work?
Recently when I was changing some Amazon account settings, I've noticed that they provide an option to validate the OTP by appending it to the password. How would this work, if the password is one-way ...
1
vote
1answer
99 views
Is it unsecure to use TOTP codes on the device that generates them?
Let's say I have a TOTP generator app (like Google Authenticator) installed on my smartphone. I use it for 2FA for service X. How bad is it if I log in to X's website/dedicated app on the same ...
3
votes
1answer
1k views
Is there a reason to change OTP code on every resend attempt?
This question is about OTP codes that are used in flows like
Email verification
SMS 2fa
Usually, when you send an OTP, you want to give the user an option to resend the OTP.
Assuming the following ...
0
votes
2answers
866 views
How to encrypt data with a one time password?
We can generate OTP using HOTP - RFC 4226 and TOTP - RFC 6238.
But the generated OTP normally has a checking function authenticator.check(token, secret);. But this only checks if the OTP is valid.
...
0
votes
2answers
646 views
one-time link on 1ty.me
1ty.me is a website that allows you to send secret messages (password, nuclear code, etc.) to someone with a one-time link. So when someone receives the link and clicks on it, the secret message is ...
3
votes
0answers
211 views
One time password: combine time window and counter
I want to generate an OTP, that is valid once in a certain time window in the future. That time window is in the range of minutes to hours. After being used in that window, the OTP may not be used ...
0
votes
1answer
2k views
Is it possible to bypass 2FA and access bank account in this system?
Nowadays, any credit/debit card transaction made online (at least for mine) requires one to enter the card details (Account No., Expiry Date, CVV etc). In the end, a OTP (One Time Pass) is sent to the ...
2
votes
1answer
569 views
Can 2FA / MFA be secure & functional in a purely offline state (PWA)?
I'm building a Progressive Web App intended to be used primarily in an offline state. The user can "login" while disconnected, which verifies the password against a locally-stored hash and some other ...
3
votes
1answer
99 views
Protect page sms verification from spamming
I'm developing a merchant page where users can pay their bills.
On this page, users must fill in their bank details (Card number, card holder name, expiration date, CVC).
As a verification, we have a ...
0
votes
0answers
196 views
Is there any Password Manager that supports Hardware-Based OTP encryption/decryption?
I see that some projects like KeepassXC use CR based OTP to provide some additional security. While this is discussed quite controversial my opinion is that - for quite some cases (e.g. most non-...
50
votes
5answers
8k views
Why do many websites hide input when entering an OTP?
I've noticed that on many sites, when they ask for a one-time password (OTP) (usually sent by SMS), the input is hidden in the same way as a password field is.
My understanding is that once an OTP is ...
