0

There's an application, which accepts a user id and password to login. Validation of the id and password is processed by another system. Now after password validation, the application generates a One Time Passcode (OTP) and sends it as an SMS or email to the user.

This OTP expires in 15-30 minutes. Only when the OTP is validated successfully does the user's login complete.

If the user has two devices, and he enters his password in one device, an OTP is generated. But he doesn't use the OTP on the first device. He uses his second device to log in again, and enters his password there. Since it is within 15-30 minutes, the same OTP is generated again. Now he can log in to two devices with the same OTP.

Does this scenario appear to be good?

Continuing the scenario, his id is locked meanwhile for some reason. He attempts to enter the OTP in either of the devices. Now should we allow the login? Otherwise, should we check the id status every time an OTP is validated?

Similarly, in the 15-30 minute interval, if password is changed via the help desk, should we reset the existing sessions that have successful password validation but are waiting for the OTP? Or can we allow the login with the older password itself?

The technical problem here is that password validation is in one system, but the OTP validation is in another system, and they are mutually exclusive. They don't communicate with each other.

Is this OTP validation procedure appropriate?

Improve this question
12
  • Sounds like you need a device id or an application instance id.
    – Robert Harvey
    Feb 17, 2016 at 22:21
  • @RobertHarvey Yes, we can introduce a device id. But, I am concerned, if I really to consider these negative scenarios?
    – Maheswaran Ravisankar
    Feb 17, 2016 at 22:23
  • Negative scenarios?
    – Robert Harvey
    Feb 17, 2016 at 22:23
  • Like id locked/password changed before the OTP expiry. Should we still allow OTP validation ?
    – Maheswaran Ravisankar
    Feb 17, 2016 at 22:24
  • I understand password changed, and I think you want that to happen before the OTP expiry. What do you mean by "id is locked?"
    – Robert Harvey
    Feb 17, 2016 at 22:25

2 Answers 2

Reset to default
3

Is this OTP validation procedure appropriate?

Your validation procedure seems mostly okay, but your generation procedure certainly is not.

Since it is within 15-30 minutes, the same OTP is generated again. Does this scenario appear to be good?

Two logins should never produce the same passcode. Ever.

When a login is attempted, generate a brand new passcode. Expire the old one immediately.

Going back to validation, though, you really should not accept the same OTP twice.

All your other questions, as far as I can tell, become moot when taking the above into consideration.

Improve this answer
2
  • Thanks, just to confirm we need not confirm the password status for this user, after OTP? Because password can be changed with a call to help desk.
    – Maheswaran Ravisankar
    Feb 18, 2016 at 3:27
  • Also, the newer OTP should be allowed in the older session? The OTP is just sticky to the user id or to the session as well ?
    – Maheswaran Ravisankar
    Feb 18, 2016 at 3:30
1

When calculating OTP values you should rely on open standards like HOTP or TOTP in RFC4226 and RFC6238. In your case - if you want the OTP value to be usable for 15 minutes - you need to use the event base HOTP (RFC4226).

This is a typical scenario as handled by privacyidea. Entering the correct password triggers the sending of an SMS where you can define the validitiy period of the sent OTP value. privacyidea supports a bunch of token types. One is the SMS token. You can use the REST API to trigger the SMS.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.