0

There's an application, which accepts a user id and password to login. Validation of the id and password is processed by another system. Now after password validation, the application generates a One Time Passcode (OTP) and sends it as an SMS or email to the user.

This OTP expires in 15-30 minutes. Only when the OTP is validated successfully does the user's login complete.

If the user has two devices, and he enters his password in one device, an OTP is generated. But he doesn't use the OTP on the first device. He uses his second device to log in again, and enters his password there. Since it is within 15-30 minutes, the same OTP is generated again. Now he can log in to two devices with the same OTP.

Does this scenario appear to be good?

Continuing the scenario, his id is locked meanwhile for some reason. He attempts to enter the OTP in either of the devices. Now should we allow the login? Otherwise, should we check the id status every time an OTP is validated?

Similarly, in the 15-30 minute interval, if password is changed via the help desk, should we reset the existing sessions that have successful password validation but are waiting for the OTP? Or can we allow the login with the older password itself?

The technical problem here is that password validation is in one system, but the OTP validation is in another system, and they are mutually exclusive. They don't communicate with each other.

Is this OTP validation procedure appropriate?

  • Sounds like you need a device id or an application instance id. – Robert Harvey Feb 17 '16 at 22:21
  • @RobertHarvey Yes, we can introduce a device id. But, I am concerned, if I really to consider these negative scenarios? – Maheswaran Ravisankar Feb 17 '16 at 22:23
  • Negative scenarios? – Robert Harvey Feb 17 '16 at 22:23
  • Like id locked/password changed before the OTP expiry. Should we still allow OTP validation ? – Maheswaran Ravisankar Feb 17 '16 at 22:24
  • I understand password changed, and I think you want that to happen before the OTP expiry. What do you mean by "id is locked?" – Robert Harvey Feb 17 '16 at 22:25
3

Is this OTP validation procedure appropriate?

Your validation procedure seems mostly okay, but your generation procedure certainly is not.

Since it is within 15-30 minutes, the same OTP is generated again. Does this scenario appear to be good?

Two logins should never produce the same passcode. Ever.

When a login is attempted, generate a brand new passcode. Expire the old one immediately.

Going back to validation, though, you really should not accept the same OTP twice.

All your other questions, as far as I can tell, become moot when taking the above into consideration.

  • Thanks, just to confirm we need not confirm the password status for this user, after OTP? Because password can be changed with a call to help desk. – Maheswaran Ravisankar Feb 18 '16 at 3:27
  • Also, the newer OTP should be allowed in the older session? The OTP is just sticky to the user id or to the session as well ? – Maheswaran Ravisankar Feb 18 '16 at 3:30
1

When calculating OTP values you should rely on open standards like HOTP or TOTP in RFC4226 and RFC6238. In your case - if you want the OTP value to be usable for 15 minutes - you need to use the event base HOTP (RFC4226).

This is a typical scenario as handled by privacyidea. Entering the correct password triggers the sending of an SMS where you can define the validitiy period of the sent OTP value. privacyidea supports a bunch of token types. One is the SMS token. You can use the REST API to trigger the SMS.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.