Questions tagged [one-time-password]

One-time password (OTP) protocols and implementations (software and hardware)

21 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
3
votes
0answers
219 views

One time password: combine time window and counter

I want to generate an OTP, that is valid once in a certain time window in the future. That time window is in the range of minutes to hours. After being used in that window, the OTP may not be used ...
3
votes
0answers
60 views

Security concerns for long-lasting single use access tokens with secondary identity verification?

I have an application that has a user type that "returns as needed" over the course of 22 days to complete action items. The application handles sensitive/confidential information, but > 90% of users ...
2
votes
1answer
91 views

Multiple login attempts made using mobile OTP in multiple customer sites at the same time

We have multiple customer sites which provides login via mobile number OTP option (new & registered users). Recently, we come across an incident where a user received 100+ OTPs with in few minutes ...
2
votes
0answers
115 views

What is the impact if there is Race Condition while submitting OTP?

I recently came across a web application where it was asking for an OTP after a successful login. Let the endpoint be https://www.example.com/otpcode The initial test for a brute-force of the OTP ...
2
votes
0answers
976 views

How is a bad actor able to disable Amazon's 2-step verification without supplying a OTP?

My wife's Amazon account was hacked yesterday. She discovered the purchases, changed her password to both gmail and Amazon, and enabled Amazon's 2-step verification (2FA) through SMS on her phone and ...
2
votes
2answers
289 views

Web Application Using Identity Federation & OTP

We are running a web application using a client's identity federation to authenticate users. A new requirement is to use 2FA, we have decided to use an OTP algorithm using Java, similar to this one ...
2
votes
0answers
214 views

Generate secure one-time codes containing information

I need to create a system that allows a user to enter codes to charge an allowance. Embedded in this code should be the amount to charge the allowance. The user would pay for a code which would then ...
1
vote
0answers
165 views

In forgotten password is asking user their TOTP among other details secure?

I have started to work on the Forgotten password feature on my website. Based on OWASP Forgot Password cheatsheet, the user should provide enough information to confirm that it is really them. The ...
1
vote
0answers
261 views

Is the password for Amazon's Kindle for PC stored on the computer's hard drive?

When first using Amazon's "Kindle for PC," it asks you for a password. Subsequent times using "Kindle for PC," it doesn't ask you for your password. Is that password stored on the computer's hard ...
1
vote
0answers
155 views

Time Based Authentication

I need a way of authenticating that a file was generated by a particular machine that has a unique ID and a unique random secret also known to the authenticator, as an added difficulty the file ...
1
vote
0answers
141 views

Store 2-legged one-time password's key securely

I have a system with a OTP authentication and I need a method to encrypt the main "secret algorithm". In my system each OTP has a pair named "solution" and it is also changing like the OTP. I need to ...
0
votes
0answers
27 views

OTP vs Passwords

People hate having passwords for numerous apps on their phone. I want to create an e-Commerce app with some social features like following friends, so I was thinking to replace the passwords and ...
0
votes
1answer
104 views

Are there still ways that OTP is safer than FIDO?

From my reading I understand that USB keys (for example Yubikeys) are more secure than OTP authentication apps (such as Google Authenticator). The primary reason is that FIDO is done without human ...
0
votes
2answers
168 views

Best practice for authenticating resend email requests

I have a Node.js/Express 4/JWT user authentication service using Passport.js, with Sequelize and MySQL for database. In my service, upon signing up/resetting a password, the user will be redirected to ...
0
votes
3answers
333 views

Is an OTP alone useful for a hacker?

Further, does an unused OTP expire by itself? i.e in regards to digital banking - in case a hacker accesses your SMS's through malware or other means.
0
votes
0answers
105 views

Combine HOTP and TOTP

I want to build a custom OTP implementation that utilizes the HOTP/TOTP algorithm. I need to create several codes (one time passwords), which are all valid for the same time window in the future (e.g....
0
votes
0answers
200 views

Is there any Password Manager that supports Hardware-Based OTP encryption/decryption?

I see that some projects like KeepassXC use CR based OTP to provide some additional security. While this is discussed quite controversial my opinion is that - for quite some cases (e.g. most non-...
0
votes
0answers
1k views

Persistent OTP on Web Browser using cookie

Currently I'm planning to use OTP for my web app, I'm a bit confused about how to keep the users logged on the app. My plan is to use cookies, but I'm not sure whether this is correct or not. This is ...
0
votes
0answers
122 views

Storing TOTP codes on a Feiteian ePass FIDO key

I'm looking for some Android apps that can store / read TOTP codes off of a Feitian ePass FIDO key using NFC. There appears to be a fairly simple way with a yubico key / and key but I don't know how ...
0
votes
1answer
258 views

Algorithms for transaction authentication

It's unclear to me how transaction signing and transaction authentication work. Industrial solutions use both symmetric and asymmetric algorithms to compute the signature. What does RSA add the one-...
0
votes
1answer
563 views

Storage of the One Time Password Seed

I'm a student and I'm working on an OTP authentication systeme based on OATH using smart phones as tokens for the clients. My problem is the protection the OTP seed at both client and validation ...