Questions tagged [one-time-password]
One-time password (OTP) protocols and implementations (software and hardware)
1
vote
1answer
58 views
What point in Authenticator App 2FA when SMS fallback is enabled
I would like to move away from SMS 2FA (because of Should 2FA over SMS be considered insecure in the wake of recent SS7 attacks? for example).
But some services that provide Authenticator apps ...
0
votes
0answers
54 views
Persistent OTP on Web Browser using cookie
Currently I'm planning to use OTP for my web app, I'm a bit confused about how to keep the users logged on the app. My plan is to use cookies, but I'm not sure whether this is correct or not.
This is ...
0
votes
1answer
106 views
Am I making my One-Time Passcode less secure?
I am using some "magic link" one-time passcodes for automatically logging users in for a specific purpose on our website.
My plan is to generate a hash based on the datetime, users specific "ID" and ...
0
votes
1answer
68 views
What will be the problems if 2 users receive the same OTP in an arbitrary time gap?
First of all, I sincerely apologise if this question has already been asked before. I searched in Google and on this website but was unable to find any article.
I have seen that most OTPs are 6 ...
0
votes
0answers
59 views
Storing TOTP codes on a Feiteian ePass FIDO key
I'm looking for some Android apps that can store / read TOTP codes off of a Feitian ePass FIDO key using NFC. There appears to be a fairly simple way with a yubico key / and key but I don't know how ...
0
votes
2answers
269 views
Which is more secure Yubikey + Keepass using Challenge/Response or Yubikey + Keepass using OTP?
I use a Windows 10 PC and an Android phone with Keepass.
I would like to add a second factor on top of my master password that works with both Windows 10 and my Android phone.
Between the two ...
2
votes
2answers
127 views
Is stand-alone one-time password less secure than OTP + traditional password auth?
I have a client that would like to use one-time passwords (via SMS or Email) for their app, and their requirements spec does not include traditional password-based authentication. I haven't seen this ...
4
votes
2answers
186 views
Telegram (or other messenger) message as second factor in 2FA
Is it safe to send code via messenger bot and use it as second factor in auth? The scheme looks like the same as SMS one. A user opens application or look at a push notification and use the code. Why ...
2
votes
1answer
87 views
Security implications of auto-submitting OTP?
So the question was originally asked as a part of the UX question here.
My question is that, Are there any security risks involved when I auto-submit the OTP? Currently, I'm limiting the number of ...
3
votes
3answers
717 views
Bank sends one-time password by e-mail (while sending on SMS) for transaction verification; is this insecure?
Most of the banks uses OTP (One Time Password) to enrich the authentication through dual factor.
But I observed Banks are sending the OTP to mobile as well as email.
I suppose sharing passwords on ...
1
vote
1answer
78 views
Is it safe to receive (One Time Password) OTP to the Mobile where the online banking application is installed?
Assume a customer of a bank is using online banking facility and he is using an online banking application on mobile (android).
There could be a possibility that particular mobile could be ...
3
votes
2answers
282 views
Do all Authenticator Apps use the same algorithm?
I've tried some Authenticator Apps (Google,Microsoft,Authy,Lastpass,...) and all of those apps generate same one time passwords at the same time ?
So, these apps are use the same algorithm which is a ...
0
votes
1answer
32 views
Will evolving bio metric capabilities on mobiles replaces online transaction verification through SMS (OTP)?
We are working on an online eCommerce site and we need to have online transactions. The common mechanism of verifying the online transaction seems the OTP (one Time Passwords) over SMS.
But this ...
1
vote
1answer
241 views
Best practices to protect public/private SSH key pair in web interface?
I've got a dilemma here: I'm working on a system that will connect to remote linux servers for monitoring and automating some processes. Since user+pass is insecure for obvious reasons and public/...
0
votes
1answer
244 views
What should be the life time for SMS OTP?
I've tried to find such a standard that mention the lifetime of SME OTP, however, NIST is no longer recommended using SMS OTP due to the risk involved.
Regardless of the security concerns, I still ...
8
votes
2answers
255 views
Why use one-time codes for two-factor authentication backups?
I am building an web application that uses two-factor authentication.
While implementing the recovery feature, I see that most companies (eg Apple, Facebook, Github) provide a set of ~15 backup codes,...
1
vote
1answer
153 views
SMS OTP as 2FA - should there be sms session id in sms for user's verification?
Several times I saw SMS 2FA implementation when a web site shows "sms session id" (say, 8 digits token) right after sending sms to user together with OTP prompt. Sms comes with OTP (say, 4 digits) and ...
1
vote
1answer
119 views
Should I reply to an email saying that I requested online access to a website?
I received an email saying I requested access to a website. The email also includes a one-time passcode. I did not do anything that would require a one-time passcode. At the bottom of the email is a ...
0
votes
2answers
350 views
OTP generation is specific to SIM or Phone number
Are the messages including OTP sent to a mobile phone addressed to the SIM card or the phone number?
If I decide to have a new phone number and the old phone number is allotted to a new customer, the ...
2
votes
4answers
389 views
Does a two-factor authentication dongle (OTP) which is always inserted in MacBook add a security benefit?
I think to get a Yubikey and read that Keepass with OTP makes no sense No. Security remains the same + extra cognitive overhead.
I try to store all data local and use seldom cloud based services.
If ...
0
votes
1answer
1k views
Why is the need to expire OTP?
OTP can be implemented either using Google Authenticator or by sending SMS to the user. The GA code is created using a timestamp and the code expires if it's used after some time.
However, in case of ...
9
votes
4answers
1k views
Prevent against OTP abuse in app sign up flow
This may sound like an open ended question, but I would like to take my chances and understand if there is any way the rest of the community is handling this issue.
Let's say there is an app that ...
1
vote
4answers
285 views
Why do (many) TOTP devices or TFA apps use none or simple access password?
In Sweden, where I live, you can use an app called BankID to identify yourself and sign into official website or sign up official documents.
The app uses a 6 digits (numerals, not alphabet or symbols) ...
0
votes
1answer
134 views
Windows Server more vulnerable for password extraction during shutdown?
Is a Windows Server (e.g. Windows Server 2008) more vulnerable during the shutdown process compared to the Server is up and running? Does the process of shutting down Windows introduce additional ...
2
votes
2answers
208 views
Web Application Using Identity Federation & OTP
We are running a web application using a client's identity federation to authenticate users. A new requirement is to use 2FA, we have decided to use an OTP algorithm using Java, similar to this one ...
3
votes
1answer
120 views
Is my authentication method secure?
I have built a web-facing tool which is mostly for internal use, but some of our clients will also make use of it. When building the registration/login parts I had a thought about who would be using ...
0
votes
1answer
114 views
How can the german ChipTAN / CardTAN system be secure?
The german ChipTAN (https://en.wikipedia.org/wiki/Transaction_authentication_number#ChipTAN_/_CardTAN) system calculates a TAN that is send to the banking server to proof the transaction. The number ...
5
votes
1answer
270 views
Yubikey Desktop Authenticator
Would you say it is more secure to use Yubikey Desktop Authenticator than Google Authenticator?
Instead of using Google Authenticator every time I want to login to some site I am wondering if it ...
19
votes
4answers
3k views
How secure are password managers with account recovery?
The major commercial password manager companies claim to have a "zero knowledge" system. This means the master password of the user is the only way to decrypt the data and it's is not stored anywhere. ...
30
votes
2answers
6k views
Is emailing sign in links bad practice?
In my Spring application, I was planning to remove passwords from the authentication process by sending a "magic sign-in link" to a user's email address. However, in this question Rob Winch (lead of ...
3
votes
1answer
101 views
Having sudo mode in a web application, why use a password instead of one time passwords?
Online services, like GitHub, have Sudo mode. Sudo mode means, that a user performing delicate actions has only to authenticate every couple of minutes, but than again, although they are already ...
1
vote
4answers
181 views
Aren't the current implementations for multi-factor authentication heavily dependent on a single point of failure?
A lot of 2-factor authentication methods seem to rely on either a text message, email or a one-time password like Google's Authenticator as the second step in authentication.
It seems like these ...
0
votes
1answer
103 views
Why send multiple codes and ask the user to input only one?
Consider the following (real-world) scenario:
When making a credit/debit card purchase online, the bank sends an SMS containing 4 different numbered “passwords” and then prompts the user to enter a ...
3
votes
4answers
3k views
Best practices for storing 2FA recovery codes
I’ve recently started using 2FA on a bunch of services and I’m not sure how to best store the recovery codes. I can think of 3 options:
In a secure note on LastPass
In a Dropbox folder
On a usb stick
...
-1
votes
1answer
733 views
Send hash password or send password to hash in server? [duplicate]
Im doing a little research in my question but no found any concrete answer.
I have a client-server architecture. Im using Bcrypt as hash function (the password its store as double hash), and HTTPS to ...
0
votes
2answers
226 views
Is this passwordless authentification system is less secure than big websites authentifications?
I develop a web and mobile Application, managed by my REST API server (SSL with Strict-Transport-Security enabled).
I don't believe anymore in the classic login/password authentification method (1)(2)(...
3
votes
1answer
1k views
Best practices for generating and using random timed OTP
Suppose I want to implement an OTP system that generates 6 to 10 digit numbers.
(assume its used for reset password, or send money)
The OTPs have an expiry time, so they keep getting removed from the ...
0
votes
2answers
219 views
Is Password Less Login mainstream? What sites are using Password Less Login? [closed]
Looks like GE's FirstBuild community site is using Password Less Login pattern. For Login, they just email a custom temporary PIN to a registered email address
I am curious which other popular sites ...
0
votes
1answer
78 views
Which approach provides more authenticity of image ownership: cropping, or reduced resolution?
Even if this particular approach likely provides medium to low assurance, which approach is more trustworthy:
Suppose I take a set of photos that I own, and crop all of them after I magnified by 25%....
1
vote
3answers
508 views
Prevention of devices using same OTP secret
I have a requirement of OTP applications on mobile devices not sharing the same secret (even if the mobile devices are owned by the same user). A single secret must be present in a single device.
...
3
votes
1answer
6k views
Why doesn't KeePass use two factor / one time password generation to protect the database?
I've read KeePass kinda sorta tries as much as is possible to limit keyloggers (at least on PC).
But since you type in your master database password on many devices many times, there's a huge chance ...
0
votes
1answer
137 views
Secure email hosting service for a law firm [closed]
I am looking for an email hosting service for a small law firm (4-5 accounts).
What i am looking for is:
Possibility of sending password (or question/answer) encrypted message to a user outside of my ...
7
votes
2answers
1k views
Is accepting the current and the previous one-time password a bad practice?
I often see two-factor authentication (2FA) methods using one-time passwords (OTP) implementations wherein the current (previous) and sometimes even 2 or 3 previous tokens are still valid. This is ...
1
vote
1answer
453 views
One-Time-Password securing an embedded server via OpenSSL
I am developing an application to secure communications between a client and an embedded linux server. I am very new to the field of cryptography, so at this stage I am looking more for guidance - ...
1
vote
1answer
102 views
inherent drawbacks of browser based OTP solutions?
We already have two sorts of OTP generators in place: (a) as hardware (token) (b) as software (e.g. Google authenticator, RedHats freeOTP)
Now I saw browser based solutions like SecureAuth OTP which ...
1
vote
2answers
1k views
Is there a way to create time based OTP with public/private key
I have a situation where I need time based OTP.
But most of the examples and cases I have seen, uses same key to create and check otp.
But I need something different. I want to create OTP using a ...
3
votes
1answer
449 views
TOTP / HOTP - Offline 1 hour password generator
I need to generate and valid a password / token for an hour.
Client -> generate password (valid for one hour)
Server -> valid it within an hour.
//System needs to work offline (TOTP)
TOTP is ...
1
vote
4answers
381 views
Implementation flow of MFA with TOTP
For a frontend, i would like to implement MFA (with TOTP).
I may be searching for the wrong keywords but i couldn't find the proper way to implement securely this solution. I was searching for a ...
1
vote
0answers
202 views
Is the password for Amazon's Kindle for PC stored on the computer's hard drive?
When first using Amazon's "Kindle for PC," it asks you for a password. Subsequent times using "Kindle for PC," it doesn't ask you for your password. Is that password stored on the computer's hard ...
6
votes
3answers
3k views
Is it secure to store a two factor authentication seed in a password manager?
I wonder whether it is really secure to store the Two Factor Authentication seed code (e.g. the secret key for TOTP) within a password manager together with the user and password for the service.
If ...
