English
Magyar
Ensuring secure access to applications and cloud-based software is a constant challenge for companies across all sectors. Providing users with simple yet reliable security is critical to protecting user information and sensitive corporate data.
Technology companies are taking steps to combat password theft and other types of cyberattacks by, amongst other things, using one-time passwords (OTPs). OTPs are a form of multi-factor authentication (MFA) designed to make it much more difficult for hackers to gain access to protected information.
MFA requires additional authentication details beyond a simple password before the end user can access an application or system. MFA using SMS, for example, sends the user a text message containing a numeric string, which they must enter before being granted access. This code is a type of OTP.
It is in the interests of both B2B and B2C companies to protect user and corporate data whilst maintaining an excellent user experience (UX), which means that whatever security solution they choose must be streamlined without drastically interfering with the user’s workflow.
OTP authentication offers an elegant solution to both security concerns and user experience. There are two types of OTP: HOTP and TOTP. Below, we outline the differences between each type. But first, let’s delve a little deeper into OTP.
What is OTP and how does it work?
An OTP is like a password, but can only be used once, hence the abbreviation for ‘one-time password’. It is often used in combination with a traditional password as an additional authentication mechanism, providing extra security.
OTP is exactly what it sounds like: one-time only. Once you’ve used a particular password, it disappears, and the next time you need to log in to that application, you’ll have to use a different one. This enhances security and makes it much harder for malicious actors to gain access to private accounts.
Users can access the OTP for a particular app or website via smartphone apps, text messages or their own token (such as a key fob). OneLogin Protect is an example of an OTP generator that you can use as an app on your phone. Whenever you receive a text message containing a code that helps you log in to a website or app, you are using an OTP.
There are numerous industry-standard algorithms, such as SHA-1, which generate OTPs. Each algorithm uses two inputs to generate the OTP code: a seed and a running factor. The seed is a static value (secret key) that is generated when you create a new account on the authentication server.
Whilst the seed remains unchanged, the moving factor changes every time a new OTP is requested. The method used to generate the moving factor is the key difference between HOTP and TOTP.
What is HOTP?
The ‘H’ in HOTP stands for Hash-based Message Authentication Code (HMAC). For non-specialists, the HMAC-based one-time password algorithm (HOTP) is an event-based OTP where the movement factor of each code is based on a counter.
Every time the HOTP is requested and validated, the rolling factor is incremented based on the counter. The generated code remains valid until you actively request a new one and it is validated by the authentication server. The OTP generator and the server synchronise every time the code is validated and the user is granted access. The Yubiko Yubikey is an example of an OTP generator that uses HOTP.
What is TOTP?
A time-based one-time password (TOTP) is a time-based OTP. The seed of a TOTP is static, just as it is with HOTP, but the running factor of a TOTP is time-based rather than counter-based.
The period during which individual passwords remain valid is known as a time step. Time steps are usually 30 or 60 seconds long. If you have not used your password within this window, it is no longer valid and you will need to request a new one to access the application.
Limitations and benefits
Although both are much more secure than not using MFA at all, both HOTP and TOTP have their limitations and advantages. TOTP (the newer of the two technologies) is easy to use and implement, but due to its time-based nature, a time lag may occur (a delay between the generation and use of the password). If the user does not enter the TOTP immediately, there is a chance that it will expire before they do so. The server must therefore take this into account and make it easy for the user to try again without automatically locking them out.
As HOTP does not have a time-based restriction, it is somewhat more user-friendly, but may be more vulnerable to brute-force attacks. This is due to the potentially longer window during which the HOTP may remain valid. Some forms of HOTP have addressed this vulnerability by adding a time-based component to their code, thereby somewhat blurring the lines between the two types of OTP.
Summary
Regardless of which type of OTP you use, choosing an OTP generator – such as an authentication app or a key fob – is a more secure way to use MFA than SMS-based options. Fraudsters have found creative ways to intercept these SMS codes, whether through SIM card fraud or other types of hacking that allow them to access your text messages. Whilst SMS-based MFA may be better than having no MFA at all, it is far less secure than having an authentication app on your phone or using a key fob code generator.