One-time password (OTP) protocols and implementations (software and hardware)
1
vote
1answer
29 views
Issues of using HOTP w/ iteration window
I am using HOTP to generate OTP to validate a request, in order to prevent replay attacks. I'm thinking about using a window of 10 (or so) iterations to accommodate a possible mismatch in the counter ...
1
vote
0answers
23 views
Is there a TOTP variant that does not require the user to type in a code? [closed]
We're considering a 2 factor TOTP solution on a mobile phone. However, it would be much easier for the user to somehow send the OTP to the server by pushing a button, rather than manually typing in a ...
1
vote
0answers
35 views
FIDO, U2F Compatibility
I've been following the FIDO standard (a consumer-friendly public-key system similar to SSH key pairs) and it appears that it's close to being complete: both Google and PayPal have been testing it ...
5
votes
1answer
143 views
Why does my bank bother asking basic personal questions to log in to online banking?
To log into my online banking, I have to answer a basic personal question such as "What is your mother's maiden name" or "What is your grandfather's middle name", as well as enter a one-time code from ...
0
votes
1answer
151 views
Why don't we do dual password instead of forgot password?
You can see a link Forgot Password? nearby almost all login form.
As I mentioned in question, Since passwords are completely protected from outside access unless owner reveal, I come up with this ...
0
votes
1answer
58 views
Are there any secure ways to store the secret key used in a TOTP scheme?
I'm writing a little webapp that demonstrates 2 factor authentication. I'm using the TOTP protocol as described in RFC 6238. In our scheme, we are storing, in addition to a b-crypted password hash ...
1
vote
2answers
258 views
How to write a rock solid TOTP implementation?
I am currently writing a TOTP implementation in PHP (but this applies to other languages as well) and of course want it to be as secure as possible, what should be considered?
After reading the ...
1
vote
2answers
52 views
HOTP/similar - how about standard backups of mobile devices?
I was considering adding HOTP as an option to my website (alongside things such as SMSed one time tokens which I already have). But I was considering one issue that HOTP inherently has:
Things such ...
3
votes
1answer
107 views
Should an administrator be able to turn off TFA for a user
We use Google Authenticator and SMS for two factor authentication. Should we allow the administrators of the site to turn off TFA for users?
Google Auth uses SMS as backup option but SMS does not ...
1
vote
2answers
367 views
Is HMAC-SHA256 and HMAC-SHA512 able to act as drop in replacement for HMAC-SHA1 in HOTP/TOTP?
In RFC 4226, the algorithm for HOTP is described as follow.
HOTP(K,C) = Truncate(HMAC-SHA-1(K,C))
TOTP is essentially the same algorithm as HOTP except for the fact that the counter C is ...
3
votes
1answer
140 views
S/Key as an alternative to UNIX passwords
There is this password system called S/Key I saw on the Internet. Can someone give me a brief description about S/Key and how it works? Can S/Key be an alternative solution to the UNIX password ...
0
votes
2answers
546 views
Google Authenticator - Counter Based [duplicate]
I'm trying to understand How google authenticator - counter based work. I have tried googling around finding a demo or at least how this work. I understand its a one time password but not like TOTP. I ...
0
votes
1answer
122 views
Storing Seed for TOTP
We have a public website for employees which has access to some sensitive company information. To make the login process more secure we want to implement TOTP. The setup and implementation has been ...
3
votes
2answers
356 views
Is OATH TOTP and / or Google Authenticator vulnerable if an attacker has (N) previous codes?
I'm not much of a ipsec initiate, so this is a bit over my head ... but I'm always willing to learn more.
Are there any known attacks against OATH TOTP (Google Authenticator's / Authy's algorithm) if ...
4
votes
2answers
2k views
Does adding two-factor authentication by OTP really make KeePass more secure
KeePass is an application that keeps all your passwords for you in a database. It is primarily protected by a master password and/or keyfile. If the database is properly encrypted with that password ...
0
votes
2answers
141 views
Using authentication only one time passwords [duplicate]
I would be interested in advice.
Imagine a authentication mechanism where users are authenticated ONLY using
some code (e.g., one time password) which they receive (say as SMS) on their mobile phone?
...
9
votes
4answers
580 views
What is the use of the “secret” displayed when setting up 2 Factor Authentication?
What is the purpose of the "secret" that is displayed when you take the picture of the QR code to set up 2 Factor Authentication on a non-Google site?
Why would you need it?
If you save it, doesn't ...
54
votes
3answers
11k views
How does Google Authenticator work?
Google Authenticator is an alternative to SMS for 2Step verification, installing an app on Android where the codes will be sent.
It works without any connectivity; it even works on plane mode. This ...
1
vote
1answer
129 views
What manufacturers create OATH HOTP cards now that InCard Technologies is no longer in business?
I purchased the following OAUTH HOTP card from Verisign. I'm intrigued by the security possibilities that this form factor provides and what customizations to the circuit logic are possible.
On ...
2
votes
2answers
103 views
Client code tampering detection
I have a server in a trusted environment. This server handles requests from clients in an a non-trusted environment. I'd like to authenticate each request and to know if the client code has been ...
2
votes
1answer
219 views
HOTP with as HMAC hashing algoritme a hash from the SHA-2 family
I'm looking into using a OTP solution.
HOTP is a OTP solution that is based on a HMAC with as hashing algorithm SHA-1. The standards defines it this way.
But... SHA1 (as we know) has been a ...
1
vote
1answer
251 views
What is more secure for voice and SMS OTP: A random number or generated similar to HOTP?
Many providers are creating OTP authentication for their sign in. However I noticed that all the voice and SMS OTPs I've come across are a series of 6 digits... similar to the HOTP RFC Standard ...
9
votes
2answers
784 views
What is the risk and mitigation of accidentally typing a YubiKey password in an open forum?
I have a YubiKey in my laptop (for testing) and accidentally broadcast my YubiKey password out to the Internet. Since this is only a test key, and has no access to anything of value, here are some ...
2
votes
2answers
345 views
Security evaluation of Vasco's Digipass Mobile SDK for OTP?
Has anybody worked with or integrated the Vasco Digipass Mobile SDK OTP generator into a custom mobile app for iOS devices?
I am currently performing a full security evaluation of the solution ...
1
vote
2answers
304 views
Can I use hardware token OTP to stop piracy?
Our firm sells an offline desktop (.exe) software, we are thinking of using OTP (from hardware token like in internet banking) to stop people from copying the software without permission. Basically, ...
2
votes
1answer
407 views
Is Dual Factor possible during boot with whole disk encryption on Mac FileVault 2
Mac FileVault 2 is the default disk encryption for newer Macs that occurs in the EFI pre-boot phase. The challenge here is that most smartcard drivers are loaded after the OS loads.
Is anyone aware ...
1
vote
3answers
396 views
What are the main weaknesses of mobile software based OTP generators?
What are the main weaknesses of Software based OTP generators like Vasco's DigiPass for Mobile?
5
votes
2answers
464 views
How to store OTP seed securely at the validating server
'Everyone' knows when storing passwords in a database this should be done securely for example by using salts and an appropriate hashing algorithm.
Most OTP (One Time Password) solutions are based on ...
3
votes
4answers
518 views
SMS Authentication: random OTP or a cryptographic one
I'm adding two-factor authentication using SMS to enhance an existing login process. Since I'm not working with physical tokens, I was wondering what is considered the safest:
Sending random 8 ...
7
votes
2answers
535 views
Replacement for One Time Passwords (OTP)
OTP may known as new generation of password security techniques, but I want to know does it still safe enough after several years of appearance or it will deprecate soon? & what would be the ...
2
votes
3answers
244 views
Why would it be a good idea for someone to get or not to get a Yubi key [closed]
In what uses would it be smart to get a Yubi key?
1
vote
1answer
92 views
How to detect suspicious tokens collected by a hacker
I previously asked a question here What's the use of adding a challenge in the otp algorithm?
Let's suppose that a hacker has succeeded to collect tokens. Is there a way to detect suspicious ...
6
votes
1answer
224 views
What's the use of adding a challenge to a one time password algorithm?
In these YouTube videos Challenge-Respond Mode and Sign Mode the customer enters a challenge into the CAP device before generating a one time password. Why not just generate the one time password ...
3
votes
1answer
2k views
Please explain Time-step in Time-Based One-Time Password Algorithm
I am studying about OTPs (One Time Passwords). I have gone through all the methods: HOTP (HMAC-based One Time Password), TOTP (Time-based One Time Password)
I have no issues with HOTP. But according ...
3
votes
3answers
1k views
Mobile OTP - Secure?
I came across Mobile-OTP, "a de facto standard for strong mobile authentication" (http://motp.sourceforge.net). The developers claim that it is very secure etc.
Reading through the implementation, I ...
