Skip to main content

Questions tagged [one-time-password]

One-time password (OTP) protocols and implementations (software and hardware)

Filter by
Sorted by
Tagged with
1 vote
2 answers
198 views

Why do OTP services always say "Never share this password"?

Whenever I receive an OTP, the service always says "Never share this password." Why do they include this message? Is it generic security advice to prevent people from being tricked into ...
user1605665's user avatar
11 votes
3 answers
3k views

What security risks do you see with wrong OTPs appearing in application logs?

An application is logging wrong OTPs (but not correct OTPs). I asked the application developers to not log wrong OTPs because I do not see any benefits. However, they do not want to modify the ...
King Lance's user avatar
0 votes
0 answers
74 views

How to avoid non-in-person "handshakes" and spoofing due to compromised URL data on NFC card

I am designing a system that allows users to purchase my NFC cards and sign up for an account on my online SaaS website. The System For the sake of explanation, assume the website is hosted at domain ...
user512716's user avatar
0 votes
2 answers
107 views

Alternatives for password where at least one secret is not know by the server, with similar transparency

Some service like Bitwarden use the password to encrypt part of your personal data, so that nobody except you can access it, and they archive this because the server only gets your password's hash ...
Delfin's user avatar
  • 103
0 votes
0 answers
83 views

One time password as passwordless authentication [duplicate]

When logging in to azure the login process emails me a short one time code to use and doesn't require a password. I am assuming it is a well trusted process in order to be used on such critical ...
Sabrina Gelbart's user avatar
31 votes
2 answers
5k views

What is the point of entering numbers in the two-factor authentication app?

Nowadays, 2FA apps usually require you to insert a number which you are presented with when trying to authenticate. For example, the following screenshot is from Microsoft Authenticator: This is ...
hb20007's user avatar
  • 559
0 votes
0 answers
103 views

Can Sending All Possible Otp Codes Within 1 Second Bypass Server Protections? [duplicate]

I'm exploring the security implications of OTP (One-Time Password) authentication and wondering about the effectiveness of server-side protections against brute force attacks. If an attacker attempts ...
Favour's user avatar
  • 1
9 votes
1 answer
3k views

Can displaying date and time on screen upon TOTP login failure makes system more vulnerable?

We are using TOTP(https://datatracker.ietf.org/doc/html/rfc6238) for a web application to enhance the security. TOTP works on UTC. if system clock drifts OR NTP is not synced, TOTP generated by ...
tushars's user avatar
  • 91
0 votes
1 answer
111 views

Are Apple TOTP verification codes the HOTP secret?

Apple provided the capability of using TOTP within iOS itself and I noticed there was a section for Use a verification code on a website or in an app which bypasses the QR Code. My question is whether ...
Archimedes Trajano's user avatar
0 votes
0 answers
906 views

Is it possible that Telegram's OTP has been hacked?

A couple of my friends have been in a kind of pickle recently. There have been attempts to hack their Telegram accounts and hackers somehow learned their one time pass codes but the login attempts ...
Artem S. Tashkinov's user avatar
0 votes
1 answer
495 views

Should i verify otp after login or before?

I am building a token-based authentication API, and I have three main methods: Register Method: It takes credentials (email, password, phone number) and creates the user, then sends an OTP message to ...
Lana Hanna's user avatar
1 vote
1 answer
151 views

Is using the computer for MFA safe?

Recently, I discovered that MFA apps just calculate that codes based on a private key and the time clock, so it's easy to use tools like gnu pass to replace those apps with your computer. But what are ...
Vitor Figueredo Marques's user avatar
1 vote
1 answer
167 views

One Time Password Mobile phone authentication

Can the Mobile phone One Time Password authentication be alphanumeric with special characters? If Yes, There will be more pros and less cons with increased security? One Time password Can a One Time ...
Prashant Akerkar's user avatar
6 votes
1 answer
710 views

Adding salt to TOTP

I'm building an high velocity auth system, used both for user to machine and machine to machine authentication and authorization. To prevent a replay attack I'm adding a nonce to each request, but in ...
Mascarpone's user avatar
0 votes
2 answers
645 views

Is reading off a OTP code over the phone standard practice?

I just called a number that I thought was my bank's and reached a customer service representative that asked me to verbally read to them a one-time passcode that was texted to my phone. Is this ...
Indigenuity's user avatar
  • 1,343
0 votes
1 answer
104 views

Does this implementation of 2FA expose valid credentials?

I have come across scenarios where a website would send OTP once a user has supplied valid username/password. A confirmation dialog e.g. An OTP has been sent to your registered mobile number would be ...
Youbecks003's user avatar
1 vote
0 answers
297 views

Does having authenticator app/OTP generator built into Password Manager defeat its purpose?

For example the KeepassOTP plugin is one of a few plugins for Keepass, that allows users to view their OTP code from within the password manager itself. Does this defeat the purpose of having a OTP as ...
northerner's user avatar
0 votes
1 answer
1k views

Offline One Time Password algorithm

Sometimes when we login in some services we should enter One Time Password or OTP that can be received via SMS, e-mail or a voice call. Among these options, there are some mobile apps that can ...
DooDoo's user avatar
  • 103
3 votes
1 answer
752 views

Does Push 2FA protect against phishing/MitM better than TOTP?

I was having the debate of TOTP vs Push Notifications and found this claim online: Is the 2FA method protected against phishing? Chart Explanation: The most common method of phishing is persuading a ...
Grooke's user avatar
  • 278
0 votes
0 answers
202 views

Can OTPs substitute password? [duplicate]

One-time passwords (OTPs) usually serve as the 2nd factor in a 2FA scheme. But, in isolation, I believe they are more secure than passwords, since they are ephemeral and passwords are still badly ...
sourcream's user avatar
  • 111
2 votes
1 answer
548 views

Is OTP an acceptable alternative to a password in single-factor authentication?

I recently discovered that when I have two-step verification disabled on my Amazon account, Amazon will allow me to sign in to my account using only my phone number and an OTP code sent via SMS. I am ...
Kevin K's user avatar
  • 123
0 votes
2 answers
299 views

Is it possible to design a system with two passwords?

Is it possible to design a system with two passwords prompts? The system will have to prompt for two passwords The system would have to validate first password before prompting for second password ...
Ninja64's user avatar
2 votes
1 answer
353 views

Is password-append OTP bad practice?

I recently encountered software that requires me to put my password followed by a TOTP token into a single entry field. (Similar as to what is depicted in this question). While it can be debated ...
Martin's user avatar
  • 121
0 votes
1 answer
219 views

SOTP - Signed One Time Password

I was thinking of a OTP algorithm that signs a randomly generated password. There are two things at play here: The MFA portal Knows the public key of the user's MFA app The user's MFA app Has a ...
Deadbeef Development's user avatar
0 votes
0 answers
336 views

Why we need complicate truncation for the OTP?

If we assume that Time based OTP generates the OTP using the hash function like SHA-3. Then, the generated OTP would Hash(Secret, Shared time). We want a shortened string rather than a full hash ...
Curious_man's user avatar
2 votes
3 answers
247 views

Creating Password from 2 different part

I’m looking for Term Or Some platform for managing Password Authentication with this way : Password construct from 2 Part , First one is static and you can make it and second Part Generate From TOTP ...
learner's user avatar
  • 21
0 votes
0 answers
190 views

Is passwordless OTP based authentication SOC2 compliant?

I have a client requirement to implement login without password. During sign in an otp will be sent to the user's email address and the user can use it to login. This will have an expiry. No password ...
Anonymous Platypus's user avatar
0 votes
1 answer
239 views

Is it more secure to receive OTP or send OTP?

I am working on a project that requires users to set up 2-Factor Authentication. As an additional option (apart from the Authenticator app), users can choose their WhatsApp number as an authentication ...
Mathew Paret's user avatar
1 vote
0 answers
114 views

Is it necessary to have keep these 4 accounts separate from password manager?

Microsoft Authenticator requires an: Outlook account Verification account iCloud account The first two are required to set up the authenticator on a new device, the latter stores all the data to be ...
Ganon's user avatar
  • 9
0 votes
0 answers
176 views

What is GitHub authentication SDT ? And why is it sending OTP from a residential number? [duplicate]

I had enabled 2FA for GitHub using a mobile number. Today when I tried to log in from a different device, during the 2FA verification time, I received the code from a consumer phone number [ +91 ...
Amlan Saha Kundu's user avatar
0 votes
2 answers
890 views

How can I use a user's own SMS service to send OTP and make mobile number verification in my Android app?

Goal: I am building a app, i want to verify user's mobile number, the way i am using is when user enters the mobile number, I send OTP to that number and ask user to enter the otp to verify the mobile ...
Bhavya Joshi's user avatar
1 vote
2 answers
308 views

Malicious SMS and iMessage Interception

I have an interesting situation on my hands. There are people in my neighborhood that have been harassing me for some time now. It appears that these individuals can are receiving my text (sms) ...
AnonAverageAlice81204's user avatar
1 vote
1 answer
169 views

Should a user refill their 2FA when they login into a different account and back?

Some of our users on our website have two or more accounts they use to log in. With each device they log in a specific device ID is generated. This device ID is stored on the device itself and on the ...
Efekan's user avatar
  • 113
6 votes
3 answers
2k views

Is it a bad idea to replace passwords with OTP?

As I understand things, given a user with proper password management (e.g. with a libre password manager like KeePassXC) the only realistic threat is having passwords leaked the following ways: A: ...
Gendarme's user avatar
  • 199
1 vote
1 answer
252 views

What’s the best way to only allow a file to be opened with multiple people’s authorisation?

Is there software available that makes it easy for multiple authorisations to be required before a file can be opened? The simplest solution I've found online is to encrypt a file with a password, ...
tds03725's user avatar
2 votes
1 answer
222 views

Backup Google Authenticator transferring QR code

I understand that saving a screenshot of the QR code during the OTP setup process is enough to back up a single account, however, is this the same for the QR code generated during the Google ...
lucasresck's user avatar
0 votes
1 answer
711 views

Storing OTP seeds in password manager [duplicate]

I am storing my passwords in a password manager (keepass). Also I am using keepass to set up one-time passwords for some accounts. Keepass is storing the seeds of the OTP's in its database. If my ...
Michael S's user avatar
  • 101
2 votes
2 answers
595 views

Are there still ways that OTP is safer than FIDO?

From my reading I understand that USB keys (for example Yubikeys) are more secure than OTP authentication apps (such as Google Authenticator). The primary reason is that FIDO is done without human ...
northerner's user avatar
1 vote
1 answer
908 views

Security of email OTP authentication

I'm building my own authentication and deciding on the signup/login flow. I'm would like some security feedback on this type of flow: User submits email address. 6 character alphanumeric one-time-...
Richard's user avatar
  • 11
0 votes
1 answer
137 views

Is this a secure way of authenticating, advice on what to change?

I have a few terminals that I currently use a static IP to authenticate. The problem is in my country the internet is not stable, so often I have to switch to mobile data, then the terminals can't ...
run_the_race's user avatar
6 votes
1 answer
1k views

Does TOTP make sense for verification codes?

I know that the concept of TOTP is for when the device on which the code is to be verified is separate from the device that is going to generate the code. However, I was wondering if it is a bad idea ...
yukashima huksay's user avatar
9 votes
4 answers
1k views

Is a "magic link" a kind of authentication?

From what am I reading, magic links require users to provide their email and the user will be sent an email with the link to sign-in, and the users can use this link to log into the system. Can this ...
bindip's user avatar
  • 91
5 votes
2 answers
954 views

Sending OTP before authentication / password verification

One of my old, rarely used computers had still an old password for my pyszne.pl / takeaway.com account stored in my browser's password manager. I tried to log into my account from that computer and ...
trejder's user avatar
  • 3,639
1 vote
2 answers
450 views

Does it make sense to split two factor authentication between identity providers

A common multi factor authentication solution will ask a user for a username+password and a one-time password. In all documents I can find both factors are asked by the same identity provider. This ...
Jeff's user avatar
  • 3,619
1 vote
2 answers
534 views

Are offline OTP systems really secure? [duplicate]

I know that OTP (One-time password) system is the most secure method for now if online. Online OTP systems, like sending code to a phone is secure because the attacker cannot know the code if he doesn'...
user254623's user avatar
1 vote
2 answers
1k views

How to verify OTP codes offline?

I have a use case to generate one time codes, and need to, in some cases, verify them offline. A use case: On arriving at customers door, the delivery agent needs to verify that they dropped off a ...
ohboy21's user avatar
  • 113
2 votes
1 answer
548 views

Multiple login attempts made using mobile OTP in multiple customer sites at the same time

We have multiple customer sites which provides login via mobile number OTP option (new & registered users). Recently, we come across an incident where a user received 100+ OTPs with in few minutes ...
Vijayabharathi's user avatar
1 vote
1 answer
551 views

How secure is to authorize a website to "trust your device"?

A bank has a form of 2FA where, after you put in your username and password, they send a code via SMS to your mobile phone and you have to put that too. On the screen asking for the SMS code, there ...
robertspierre's user avatar
2 votes
0 answers
460 views

What is the impact if there is Race Condition while submitting OTP?

I recently came across a web application where it was asking for an OTP after a successful login. Let the endpoint be https://www.example.com/otpcode The initial test for a brute-force of the OTP ...
Joel Deleep's user avatar
1 vote
1 answer
304 views

What are the security flaws in web based TOTP app?

If there is a widely accessible TOTP website (prototype: https://depperm.github.io/) that allows users to set a date and secret they can remember or a package that allows companies/developers to ...
depperm's user avatar
  • 117

1
2 3 4 5 6