Hot answers tagged

5

Have a look how the HOTP (TOTP is just a special case based on a time for now) is calculated. It is using HMAC based on hash function either SHA1, SHA2 (or MD5 in worst security case) of secret seed and some counter. It is returning some part of the result as a PIN. As an attacked intercepting the PINs, you are trying to find out a secret seed of unknown ...


4

Most HOTP/TOTP apps are essentially the same; the algorithms are publicly documented, so most users merely see slight UI differences. However, there are a few security things you might consider when choosing one: Is it open-source? Google Authenticator, for instance, used to be, but no longer is (which IIRC directly inspired RedHat's FreeOTP). However ...


4

If you're designing your own authentication app; instead of scanning the OTP token, scan an authorization token that will then be used to retrieve the OTP from a server. The server can then be setup to only release the token once. Bundle certificate pinning into your application, and you're good to too. The flow would look like this. User requests OTP ...


3

Yes. Concept of two factors is to authenticate using any combination of the below methods Something you know (password) Something you have (OTP token with secret) Something you are - Fingerprint, retina , palm scan etc... If you hide both of them under third password (or even without password), you are weakening the whole concept. If the attacker can get ...


2

I totally understand your need, since scanning the QR Code with the Google Authenticators KeyURI will result in "copies" of the authentication possession. Interesting enough there is an RFC for this: https://www.rfc-editor.org/rfc/rfc6063.txt But my suspicion is that this might be a bit overkill. I am working on our own authentication server which apart ...


2

You may wish to use the device ID to implement a deterministic secret unique per device as described in the RFC 4226, nothing enforce the secret to be transmitted (but it's recommended to use the random generation). We distinguish two different cases: - A single master key MK is used to derive the shared secrets; each HOTP device has a ...


2

That is not a good idea for several reasons: OTP has to be second factor! It can not be the only factor in authentication 30 seconds for TOTP is secure because during that time attacker can not test all the possible options + the first factor. For 6 digits it is 1000000 combinations and after 30 seconds (>3000 combinations per second), the combination is ...


2

An answer to your question will depend on what exactly you're using the counter value for. There are various OTP schemes. One, HOTP, is using a counter, so maybe you're talking about an HOTP implementation. However, your question could also imply that you have a list of valid passwords lying around and you need to remember which one is the next valid one. ...


1

Am I forgetting something important? Yes. The HOTP scheme is not ment to be used as a single factor. You need to ask yourself, if the "possession" of a smartphone can be seen as a strong possession factor. When evaluating 2FA or - in your case - 1FA you should take a look at the possible attacks. One way @Ry already pointed out, being simply the odds/...


1

If it breaks 2FA authentication or not, depends on the implementation. Those implementations you specify do remove the "2factor" out of 2FA and reduce it to single factor (the seed then becomes like a second "password" to your account). Same applies to using a soft-token in a Android/iPhone unless the token specifically uses secure Android Keystore bound to ...


1

When you are using OTP based on HOTP or TOTP locally you need to store the seed somewhere. So you store the seed on this local machine. Now it depends on your threats. This may very well protect you against shoulder surfers or maybe keyloggers. But it will not protect you against local attacks. But the question is, if you do not have a bigger problem, if ...


Only top voted, non community-wiki answers of a minimum length are eligible