2022 Developer Survey is open! Take survey.

Questions tagged [one-time-password]

One-time password (OTP) protocols and implementations (software and hardware)

Filter by
Sorted by
Tagged with
0 votes
1 answer
80 views

Is it possible to design a system with two passwords?

Is it possible to design a system with two passwords prompts? The system will have to prompt for two passwords The system would have to validate first password before prompting for second password ...
user avatar
2 votes
1 answer
198 views

Is password-append OTP bad practice?

I recently encountered software that requires me to put my password followed by a TOTP token into a single entry field. (Similar as to what is depicted in this question). While it can be debated ...
user avatar
0 votes
1 answer
37 views

SOTP - Signed One Time Password

I was thinking of a OTP algorithm that signs a randomly generated password. There are two things at play here: The MFA portal Knows the public key of the user's MFA app The user's MFA app Has a ...
user avatar
0 votes
0 answers
55 views

Why we need complicate truncation for the OTP?

If we assume that Time based OTP generates the OTP using the hash function like SHA-3. Then, the generated OTP would Hash(Secret, Shared time). We want a shortened string rather than a full hash ...
user avatar
0 votes
1 answer
35 views

Creating Password from 2 different part

I’m looking for Term Or Some platform for managing Password Authentication with this way : Password construct from 2 Part , First one is static and you can make it and second Part Generate From TOTP ...
user avatar
0 votes
0 answers
37 views

Is passwordless OTP based authentication SOC2 compliant?

I have a client requirement to implement login without password. During sign in an otp will be sent to the user's email address and the user can use it to login. This will have an expiry. No password ...
user avatar
0 votes
1 answer
81 views

Is it more secure to receive OTP or send OTP?

I am working on a project that requires users to set up 2-Factor Authentication. As an additional option (apart from the Authenticator app), users can choose their WhatsApp number as an authentication ...
user avatar
0 votes
0 answers
21 views

Is there an advantage for using two OTP codes when adding an authenticator?

When you initially add an OTP authenticator to an AWS account Amazon requires you to sit there for 30 seconds to put in two OTP codes. In my experience it is nearly universal that you are only asked ...
user avatar
  • 101
1 vote
0 answers
71 views

Is it necessary to have keep these 4 accounts separate from password manager?

Microsoft Authenticator requires an: Outlook account Verification account iCloud account The first two are required to set up the authenticator on a new device, the latter stores all the data to be ...
user avatar
  • 9
0 votes
0 answers
34 views

What is GitHub authentication SDT ? And why is it sending OTP from a residential number? [duplicate]

I had enabled 2FA for GitHub using a mobile number. Today when I tried to log in from a different device, during the 2FA verification time, I received the code from a consumer phone number [ +91 ...
user avatar
0 votes
2 answers
110 views

How can I use a user's own SMS service to send OTP and make mobile number verification in my Android app?

Goal: I am building a app, i want to verify user's mobile number, the way i am using is when user enters the mobile number, I send OTP to that number and ask user to enter the otp to verify the mobile ...
user avatar
0 votes
2 answers
140 views

Malicious SMS and iMessage Interception

I have an interesting situation on my hands. There are people in my neighborhood that have been harassing me for some time now. It appears that these individuals can are receiving my text (sms) ...
user avatar
1 vote
1 answer
46 views

Should a user refill their 2FA when they login into a different account and back?

Some of our users on our website have two or more accounts they use to log in. With each device they log in a specific device ID is generated. This device ID is stored on the device itself and on the ...
user avatar
  • 113
5 votes
3 answers
381 views

Is it a bad idea to replace passwords with OTP?

As I understand things, given a user with proper password management (e.g. with a libre password manager like KeePassXC) the only realistic threat is having passwords leaked the following ways: A: ...
user avatar
  • 189
0 votes
1 answer
120 views

What’s the best way to only allow a file to be opened with multiple people’s authorisation?

Is there software available that makes it easy for multiple authorisations to be required before a file can be opened? The simplest solution I've found online is to encrypt a file with a password, ...
user avatar
0 votes
0 answers
30 views

OTP vs Passwords [duplicate]

People hate having passwords for numerous apps on their phone. I want to create an e-Commerce app with some social features like following friends, so I was thinking to replace the passwords and ...
user avatar
  • 1
2 votes
1 answer
111 views

Backup Google Authenticator transferring QR code

I understand that saving a screenshot of the QR code during the OTP setup process is enough to back up a single account, however, is this the same for the QR code generated during the Google ...
user avatar
0 votes
1 answer
249 views

Storing OTP seeds in password manager [duplicate]

I am storing my passwords in a password manager (keepass). Also I am using keepass to set up one-time passwords for some accounts. Keepass is storing the seeds of the OTP's in its database. If my ...
user avatar
  • 101
0 votes
2 answers
272 views

Are there still ways that OTP is safer than FIDO?

From my reading I understand that USB keys (for example Yubikeys) are more secure than OTP authentication apps (such as Google Authenticator). The primary reason is that FIDO is done without human ...
user avatar
0 votes
1 answer
241 views

Security of email OTP authentication

I'm building my own authentication and deciding on the signup/login flow. I'm would like some security feedback on this type of flow: User submits email address. 6 character alphanumeric one-time-...
user avatar
0 votes
1 answer
100 views

Is this a secure way of authenticating, advice on what to change?

I have a few terminals that I currently use a static IP to authenticate. The problem is in my country the internet is not stable, so often I have to switch to mobile data, then the terminals can't ...
user avatar
5 votes
1 answer
678 views

Does TOTP make sense for verification codes?

I know that the concept of TOTP is for when the device on which the code is to be verified is separate from the device that is going to generate the code. However, I was wondering if it is a bad idea ...
user avatar
5 votes
4 answers
415 views

Is a "magic link" a kind of authentication?

From what am I reading, magic links require users to provide their email and the user will be sent an email with the link to sign-in, and the users can use this link to log into the system. Can this ...
user avatar
  • 51
4 votes
2 answers
604 views

Sending OTP before authentication / password verification

One of my old, rarely used computers had still an old password for my pyszne.pl / takeaway.com account stored in my browser's password manager. I tried to log into my account from that computer and ...
user avatar
  • 3,287
1 vote
2 answers
181 views

Does it make sense to split two factor authentication between identity providers

A common multi factor authentication solution will ask a user for a username+password and a one-time password. In all documents I can find both factors are asked by the same identity provider. This ...
user avatar
  • 3,589
1 vote
2 answers
216 views

Are offline OTP systems really secure? [duplicate]

I know that OTP (One-time password) system is the most secure method for now if online. Online OTP systems, like sending code to a phone is secure because the attacker cannot know the code if he doesn'...
user avatar
1 vote
2 answers
311 views

How to verify OTP codes offline?

I have a use case to generate one time codes, and need to, in some cases, verify them offline. A use case: On arriving at customers door, the delivery agent needs to verify that they dropped off a ...
user avatar
  • 113
2 votes
1 answer
166 views

Multiple login attempts made using mobile OTP in multiple customer sites at the same time

We have multiple customer sites which provides login via mobile number OTP option (new & registered users). Recently, we come across an incident where a user received 100+ OTPs with in few minutes ...
user avatar
1 vote
1 answer
102 views

How secure is to authorize a website to "trust your device"?

A bank has a form of 2FA where, after you put in your username and password, they send a code via SMS to your mobile phone and you have to put that too. On the screen asking for the SMS code, there ...
user avatar
2 votes
0 answers
222 views

What is the impact if there is Race Condition while submitting OTP?

I recently came across a web application where it was asking for an OTP after a successful login. Let the endpoint be https://www.example.com/otpcode The initial test for a brute-force of the OTP ...
user avatar
1 vote
1 answer
136 views

What are the security flaws in web based TOTP app?

If there is a widely accessible TOTP website (prototype: https://depperm.github.io/) that allows users to set a date and secret they can remember or a package that allows companies/developers to ...
user avatar
  • 113
1 vote
1 answer
164 views

6 digit code to access the account?

All my security senses are tiggling when I wrote the title, but here's the scenario: When a user wants to connect to their account, but can't remember their password, they can use the "Lost ...
user avatar
  • 2,649
2 votes
1 answer
168 views

Why don't OTPs have letters?

Is there a reason why OTPs (one-time passwords) are only made up of numbers? I've seen OTPs of varying lengths but all of them are only made up of numbers. Why are they not alphanumeric?
user avatar
5 votes
1 answer
529 views

Securely detecting and correcting time drift for TOTP

RFC 6238 recommends the server to implement some form of resynchronization algorithm to account for time drift of the device used to generate the OTP. However, the RFC provides very little information ...
user avatar
19 votes
7 answers
6k views

Don't one-time recovery codes for 2FA introduce a backdoor?

Although using multi-factor authentication is clearly a good move, I'm struggling with the 'one-time recovery codes' concept. It seems to me that if you choose to use them, what you're doing is ...
user avatar
  • 307
1 vote
0 answers
80 views

Can OTP (One-Time password) be used to protect data after intrusion has been detected? [closed]

I am working on Social Engineering attacks happening via SMSs. Let's assume a person receives an SMS asking him to click on a malicious link. If a virus is installed on the person's device, how can ...
user avatar
  • 11
3 votes
1 answer
784 views

How should I share a TOTP shared key with my users?

I want to add one-time passwords as gates for certain important actions in the application I am working on. It is not two-factor authentication, although it may be extended to that use case later. ...
user avatar
  • 133
4 votes
2 answers
991 views

Magic links: JWT vs random string

Tutorials I've come across about implementing magic link authentication (in Node) recommend a mechanism like this: the user hits your endpoint with their email address you generate a signed JWT from ...
user avatar
0 votes
2 answers
195 views

Protecting OTP based authentication

Let's say I have a website which uses 4 digit OTP based authentication for login i.e. users will enter their mobile number, receive OTP on the entered mobile number, enter the received OTP to login ...
user avatar
2 votes
0 answers
244 views

In forgotten password is asking user their TOTP among other details secure?

I have started to work on the Forgotten password feature on my website. Based on OWASP Forgot Password cheatsheet, the user should provide enough information to confirm that it is really them. The ...
user avatar
  • 3,733
2 votes
1 answer
196 views

Is phone number verifications with SMS magic HTTP links less secure than OTP?

I want to verify phone number ownership with specially crafted and encrypted payload within an HTTP hyperlink callback through SMS as opposed to sending an SMS OTP code and writing it back in server ...
user avatar
  • 23
30 votes
6 answers
6k views

Is revealing the phone number during OTP verification process considered a vulnerability?

One of the common way of implementing 2FA is using phone number Text message or Call with OTP. As I can see, usually web services show something like: OTP was sent to the number +*********34 Is it ...
user avatar
0 votes
2 answers
238 views

Best practice for authenticating resend email requests

I have a Node.js/Express 4/JWT user authentication service using Passport.js, with Sequelize and MySQL for database. In my service, upon signing up/resetting a password, the user will be redirected to ...
user avatar
  • 1
1 vote
1 answer
130 views

Password protected wall

I'm currently building a website where you have an account and can do "dangerous" things with it. I want to password-protect these things, so the user has to type their password, if they ...
user avatar
  • 142
4 votes
1 answer
1k views

How is a bad actor able to disable Amazon's 2-step verification without supplying a OTP?

My wife's Amazon account was hacked yesterday. She discovered the purchases, changed her password to both gmail and Amazon, and enabled Amazon's 2-step verification (2FA) through SMS on her phone and ...
user avatar
  • 183
0 votes
1 answer
529 views

What could be the reasons for two different OTP messages for the same merchant when we do online transactions through debit card?

While I was doing a transaction (say adding money to one of the mobile wallets) through a SBI debit card, I could see two different OTP messages for different transactions. (Please refer to the image) ...
user avatar
1 vote
2 answers
209 views

In case of TOTP code generation, why do products prefer a generic authenticator apps, such as Google Authenticator?

All the products supporting TOTP-based 2FA use one of the common authenticator apps such as Google Authenticator, Authy, etc. I want to understand whether there are any security reasons behind why ...
user avatar
1 vote
2 answers
3k views

Why my mobile sends SMS to a random number without my permission?

My mobile sends SMS to random numbers without my permission. All messages are sent automatically. Here is an example of an SMS. SBIUPI qUrXgeX26iEY%2B2si9JHhubIjm7R2aHoo6pWcbXBpJho%3D All the ...
user avatar
1 vote
3 answers
452 views

Is an OTP alone useful for a hacker?

Further, does an unused OTP expire by itself? i.e in regards to digital banking - in case a hacker accesses your SMS's through malware or other means.
user avatar
1 vote
1 answer
172 views

A proposal for effortless two-factor authentication

I have an idea for device-level two-factor authentication that involves no direct input from the user, and I wanted to find out if something like it has been tried before. Let's say I have an account ...
user avatar
  • 13

1
2 3 4 5